[SSSD] [PATCH] correctly resolve nested groups (#264)

Simo Sorce ssorce at redhat.com
Wed Dec 2 21:22:59 UTC 2009


On Tue, 2009-12-01 at 09:49 -0500, Simo Sorce wrote:
> The current code use some rough heuristics to determine if an object is
> a group or a user when calculating group memberships.
> That code easily breaks if you do not set a separate specific group base
> dn and is generally too tied to a specific DIT configuration.
> 
> The following patches instead actively lookup entries by their original
> DN so that group memberships can be translated correctly.
> 
> The patch uses a dirty trick for now, it uses a synchronous[1] search
> (looping in place) to fetch the local entry. This was done to minimize
> the impact of the patch.
> 
> 0001 talking with nalin it turns out that rfc2307bis is supposed to
> implement also nested groups, so I changed the code to do the same we do
> for ipa/ad servers in this case, and resolve nested groups.
> 
> 0002 a patch that makes a couple of functions available to external
> callers
> 
> 0003 the patch that actually fixes #264
> 
> Simo.
> 
> 
> 
> [1] In general operations against the local ldb are "fake asynchronous"
> anyway when using the tdb backend. I am considering a future set of
> patches to make the sysdb code more synchronous like we did for the
> confdb code. The sysdb code was initially made asynchronous because we
> were considering using also the ldb_ldap backend, but it turned up we
> didn't.

I've rebased these patches on top of the other memberof fixes.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-Resolve-nested-groups-also-when-rfc2307bis-is-used.patch
Type: text/x-patch
Size: 4164 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091202/9966d735/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-Make-strdn-build-functions-more-available.patch
Type: text/x-patch
Size: 5258 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091202/9966d735/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-Fix-nested-group-memberships.patch
Type: text/x-patch
Size: 30917 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091202/9966d735/attachment-0002.bin>


More information about the sssd-devel mailing list