Title: #877: SYSDB: Delete linked local user overrides when deleting a user
On Wed, Sep 04, 2019 at 03:43:15AM -0700, sumit-bose wrote:
I'm asking because the override data is currently only stored in
the cache and if it is removed it is lost. If now a cached entry gets removed
accidentally on the server or by a bug on the client and is added later again the override
data will be missing.
You are right, the sss_override command could (and probably should) be
improved to ignore userOverride objects without maching user objects, or
at least print a warning to notify the problem and let an admin remove
the orphaned entries. Also a prune subcommand to remove those entries
would be nice.
The problem is that even if an orphaned userOverride exists in the cache
and the matching user is added back the override won't work because
the 'overrideDN' attribute in the user object is only added by the
sss_override command. I thought about adding logic to search matching
userOverrides by computing the DN and restore the overrideDN when adding
an user to the cache, but I think the current approach is safer.
See the full comment at https://github.com/SSSD/sssd/pull/877#issuecomment-527855018