[SSSD] [PATCH] correctly resolve nested groups (#264)

Simo Sorce ssorce at redhat.com
Tue Dec 1 14:49:16 UTC 2009


The current code use some rough heuristics to determine if an object is
a group or a user when calculating group memberships.
That code easily breaks if you do not set a separate specific group base
dn and is generally too tied to a specific DIT configuration.

The following patches instead actively lookup entries by their original
DN so that group memberships can be translated correctly.

The patch uses a dirty trick for now, it uses a synchronous[1] search
(looping in place) to fetch the local entry. This was done to minimize
the impact of the patch.

0001 talking with nalin it turns out that rfc2307bis is supposed to
implement also nested groups, so I changed the code to do the same we do
for ipa/ad servers in this case, and resolve nested groups.

0002 a patch that makes a couple of functions available to external
callers

0003 the patch that actually fixes #264

Simo.



[1] In general operations against the local ldb are "fake asynchronous"
anyway when using the tdb backend. I am considering a future set of
patches to make the sysdb code more synchronous like we did for the
confdb code. The sysdb code was initially made asynchronous because we
were considering using also the ldb_ldap backend, but it turned up we
didn't.


-- 
Simo Sorce * Red Hat, Inc * New York
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Resolve-nested-groups-also-when-rfc2307bis-is-used.patch
Type: text/x-patch
Size: 4164 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091201/189eca78/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Make-strdn-build-functions-more-available.patch
Type: text/x-patch
Size: 5258 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091201/189eca78/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-Fix-nested-group-memberships.patch
Type: text/x-patch
Size: 30917 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091201/189eca78/attachment-0002.bin>


More information about the sssd-devel mailing list