URL:
https://github.com/SSSD/sssd/pull/402
Author: jhrozek
Title: #402: LDAP: Allow autogenerating user-private groups
Action: opened
PR body:
"""
This PR exposes the already existing feature that generates private groups
for user objects for the generic LDAP provider. Most of the work in the
PR is tests and different corner cases, but there is also one commit that is
technically backwards incompatible:
SYSDB: Prevent users and groups ID collision in MPG domains
Without checks for the collision, if an LDAP domain contains both a user
entry and a group with the same gidNumber and the group is cached first,
then the user is requested and cached, at that point the responder search
by ID would return two objects. Therefore we need to guard against the
duplicate IDs.
Instead of the backwards incompatible change, we could also enable the
check if the domain is neither subdomain nor a id_provider=local domain or
we could prefer the user object if a group-by-GID search returns two results.
But both alternatives seem like quite a hack to me and at the same time I
wasn't able to find a way where the change matters except for the local
domain -- and in that case I think the local domain doesn't matter as
a whole.
I've also sent a design page to the
sssd-devel mailing list, my WIP version is at
https://pagure.io/fork/jhrozek/SSSD/docs/blob/mpg/f/design_pages/auto_pri...
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/402/head:pr402
git checkout pr402