[SSSD] [PATCH] fix nested groups

David O'Brien davido at redhat.com
Fri Dec 4 01:51:14 UTC 2009


David O'Brien wrote:
> Simo Sorce wrote:
>> On Wed, 2009-12-02 at 16:27 -0500, Jenny Galipeau wrote:
>>> Hey, can you give me these scenarios?  I have automated tests that
>>> check 
>>> that member and memberof attributes are removed when associated
>>> groups 
>>> and or user members are deleted.   I would like to expand these tests 
>>> for regression testing of the problem.
>> Ah yes very easy to test actually.
>>
>> This is the test I used:
>> Create 5 groups A,B,C,D,E
>> Create 5 users a,b,c,d,e
>> Add each user to the corresponding group then add each group to another,
>> this is the tree I end up with:
>>
>> BEWARE!! ASCII art follows :)
>>
>> A--a
>> |
>> \--B--b
>>    |
>>    \--C--c
>>       |
>>       \--D--d
>>          |
>>          \--E--e
>>
>> Therefore the memberof attrs for each user are:
>>
>> a -> A
>> b -> A,B
>> c -> A,B,C
>> d -> A,B,C,D
>> e -> A,b,C,D,E
>>
>>
>> now delete group C
>>
>> the results must be:
>>
>> a -> A
>> b -> A,B
>> c -> none
>> d -> D
>> e -> D,E
>>
>> If they are different there is a bug.
>>
>> Simo.
>>
>>
>>
>>
> How can I determine which groups are members of which other groups?
> 
> I created GroupA and GroupB, making B a member of A
> I created UserA and UserB, making them members of obvious groups.
> 
> # getent -s sss group
> GroupA:*:511:UserA,UserB
> GroupB:*:512:UserB
> 
> That's fine, but how do I know that UserB is a member of GroupA only 
> because of group nesting?
> 
> thanks
> 
And, use cases for group nesting? Why is it a good thing?

-- 

David O'Brien
Red Hat Asia Pacific
+61 7 3514 8189

http://freeipa.org/page/DocumentationPortal
http://git.fedorahosted.org/git/ipadocs.git


"The most valuable of all talents is that of never using two words when
one will do."
     Thomas Jefferson



More information about the sssd-devel mailing list