Hi,
the attached patch fixes
https://fedorahosted.org/sssd/ticket/2646. See
the commit message for the problem description. The bug was found by
Lukas (thanks!), I just wrote the patch.
I was not really happy with some parts of the patch myself, but I
couldn't find a better way to fix the ticket. Here are some parts of the
patch that I think need careful review:
- is_fake_tgs_group() uses heuristics based on the AD schema, RDN value
and and POSIX/non-POSIX flag. Is that OK or too much of a hack?
- sdap_get_tokengroup_members() plays a bit of a trick on the memory
hierarchy. I wanted the API of this function to only return a single
member (a ldb_message_element) but at the same time, the cache search
returns only the top-level ldb_message and the first element as talloc
pointers. So the functions returns the element, which points to the
message, but the element owns the message. I checked with valgrind that
there are no memory errors. I really want to avoid copying all the
members, because that number can go to thousands. The only alternative
that comes to mind is to run a second cache search only for the member
attribute, then the member would be a talloc pointer -- but this way
seems to rely a bit on ldb implementation which I don't like either.
- sdap_save_grpmem() and sdap_save_groups() now use a saved_ldap_group
structure. This means we now need to do an extra allocation per group,
but the number of groups is usually not that big (max. hundreds,
definitely not thousands like members).
Thanks for review!