jhrozek commented on a pull request

""" On Tue, Aug 30, 2016 at 11:47:09AM -0700, lslebodn wrote:

Please provide a test-case (probably a hierarchy of groups)

I was able to reproduce with: $ ipa group-show group20 Group name: group20 GID: 935600011 Member groups: group10, group11 Indirect Member users: user1 $ ipa group-show group10 Group name: group10 GID: 935600008 Member users: user1 Member of groups: group20 $ ipa group-show group11 Group name: group11 GID: 935600009 Member users: user1 Member of groups: group20

Before the patch, group20 wasn't resolved, after the patch it was.

btw I had this group hierarhcy pre-created on my test IPA server which makes me wonder a bit how we didn't see this bug before, I'm sure I created it for some reason. Also I'm surprised a lot none of the downstream tests we were running caught the bug.

About the discussion I saw on #sssd in backscroll, the rfc2307bis schema only uses the member attribute because IIRC the RFC doesn't talk about memberof at all. But in IPA, we know the specifics on the schema, so we are able to dereference the memberof attribute to get a complete list of all groups with one call.

"""

See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-243553980