[SSSD] [PATCH] fix nested groups

Sumit Bose sbose at redhat.com
Fri Dec 4 07:53:54 UTC 2009


On Fri, Dec 04, 2009 at 10:57:21AM +1000, David O'Brien wrote:
> Simo Sorce wrote:
> > On Wed, 2009-12-02 at 16:27 -0500, Jenny Galipeau wrote:
> >> Hey, can you give me these scenarios?  I have automated tests that
> >> check 
> >> that member and memberof attributes are removed when associated
> >> groups 
> >> and or user members are deleted.   I would like to expand these tests 
> >> for regression testing of the problem.
> > 
> > Ah yes very easy to test actually.
> > 
> > This is the test I used:
> > Create 5 groups A,B,C,D,E
> > Create 5 users a,b,c,d,e
> > Add each user to the corresponding group then add each group to another,
> > this is the tree I end up with:
> > 
> > BEWARE!! ASCII art follows :)
> > 
> > A--a
> > |
> > \--B--b
> >    |
> >    \--C--c
> >       |
> >       \--D--d
> >          |
> >          \--E--e
> > 
> > Therefore the memberof attrs for each user are:
> > 
> > a -> A
> > b -> A,B
> > c -> A,B,C
> > d -> A,B,C,D
> > e -> A,b,C,D,E
> > 
> > 
> > now delete group C
> > 
> > the results must be:
> > 
> > a -> A
> > b -> A,B
> > c -> none
> > d -> D
> > e -> D,E
> > 
> > If they are different there is a bug.
> > 
> > Simo.
> > 
> > 
> > 
> > 
> How can I determine which groups are members of which other groups?
> 
> I created GroupA and GroupB, making B a member of A
> I created UserA and UserB, making them members of obvious groups.
> 
> # getent -s sss group
> GroupA:*:511:UserA,UserB
> GroupB:*:512:UserB
> 
> That's fine, but how do I know that UserB is a member of GroupA only 
> because of group nesting?
> 
> thanks
> 

You have no chance to see this at the level of getent. If you are using
IPA or AD as your backends, you can use the tools of the server to
figure out which group is a member of which other group. For sssd's
LOCAL provider we should provide a tool like sss_groupinfo which can
display group membership of groups. Any opinions ?

bye,
Sumit



More information about the sssd-devel mailing list