[SSSD] Group results.

Martinsson Patrik patrik.martinsson at smhi.se
Fri Dec 10 18:36:23 UTC 2010


>'memberOf' is the reverse of 'member', not of 'memberuid'. AD doesn't
> create the 'memberOf' backlink for entries specified by 'memberuid'
> (because 'memberuid' members are also not required to be in the
central
> server; they can be local accounts or accounts provided by a different
> directory like NIS)
Ok, understood. 

> I'm not sure what the relevance is to that statement. If you're using
> 'ldap_schema = rfc2307', then it should be adding all members that
> appear as 'memberuid' in the group.
> 
> I guess I don't understand what your question is here. It looks like
> things are behaving as expected.
Well, the group aapp has 6 memberUid, but only three of them is added by
sssd, how is that correct ? Or what am I missing ? 

Here are the users according to ldapsearch, 
dn: CN=aapp,OU=Groups,DC=xx,DC=xx,DC=xx
memberUid: a001721
memberUid: a000569
memberUid: a000680
memberUid: a001406
memberUid: a000898
memberUid: a000590

Here are the users beeing added by sssd, 
a001721
a001406
a000898

And that is with ldap_schema = rfc2307 in the config. 

/Patrik Martinsson










On Fri, 2010-12-10 at 12:20 -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 12/10/2010 10:56 AM, Patrik Martinsson wrote:
> > Ok, Cool.
> > 
> > So, I stopped sssd, removed the cachefile for my domain, started it with 
> > logging to file.
> > Since I'm not comfortable with exposing our whole ad to the internet I 
> > pasted a snippet out of the logfile, please tell me if you need anything 
> > more.
> > 
> > But the behavior is the same, here is an example,
> > I have a group called aapp,
> > 
> > ldapsearch 'ou=Groups,dc=xx,dc=xx,dc=xx' "(&(objectclass=*)(cn=aapp))" 
> > returns,
> > 
> > ------
> > member: CN=xxxx,OU=People,DC=xx,DC=xx,DC=xx
> > member: CN=xxxx,OU=People,DC=xx,DC=xx,DC=xx
> > member: CN=xxxx,OU=People,DC=xx,DC=xx,DC=xx
> > memberUid: xxxx
> > memberUid: xxxx
> > memberUid: xxxx
> > memberUid: xxxx
> > memberUid: xxxx
> > memberUid: a000590
> > ------
> > 
> > ldapsearch 'ou=People,dc=xx,dc=xx,dc=xx' 
> > "(&(objectclass=*)(cn=a000590))" | grep -i memberof returns a list of 
> > groups, however _not_ aapp.
> > 
> > So, the "groupobject" lists a000590 as a memberUid, but the "userobject" 
> > dosn't list aapp as a memberOf. First of all, is that right ?
> > 
> 
> 'memberOf' is the reverse of 'member', not of 'memberuid'. AD doesn't
> create the 'memberOf' backlink for entries specified by 'memberuid'
> (because 'memberuid' members are also not required to be in the central
> server; they can be local accounts or accounts provided by a different
> directory like NIS)
> 
> 
> 
> > Here's sssd log snippets, (tell me if you need anything else).
> > 
> > (Fri Dec 10 16:38:12 2010) [sssd[be[xx]]] [sdap_parse_entry] (9): 
> > OriginalDN: [CN=aapp,OU=Groups,DC=xx,DC=xx,DC=xx].
> > (Fri Dec 10 16:38:12 2010) [sssd[be[xx]]] [sdap_process_result] (8): 
> > Trace: sh[0xae77a0], connected[1], ops[0xae80f0], ldap[0xae79c0]
> > (Fri Dec 10 16:38:22 2010) [sssd[be[xx]]] [sdap_save_group_send] (7): 
> > Adding original DN [CN=aapp,OU=Groups,DC=xx,DC=xx,DC=xx] to attributes 
> > of [aapp].
> > (Fri Dec 10 16:38:22 2010) [sssd[be[xx]]] [sdap_save_group_send] (6): 
> > Storing info for group aapp
> > (Fri Dec 10 16:38:22 2010) [sssd[be[xx]]] [sysdb_search_entry_done] (6): 
> > Error: Entry not Found!
> > (Fri Dec 10 16:38:22 2010) [sssd[be[xx]]] [sysdb_search_entry_done] (6): 
> > Error: Entry not Found!
> > (Fri Dec 10 16:38:22 2010) [sssd[be[xx]]] [sdap_save_groups_loop] (9): 
> > Group 592 processed!
> > (Fri Dec 10 16:39:05 2010) [sssd[be[xx]]] [sdap_save_grpmem_send] (7): 
> > Adding member users to group [aapp]
> > (Fri Dec 10 16:39:05 2010) [sssd[be[xx]]] [sdap_fill_memberships] (9): 
> > [IPA or AD Schema]
> > (Fri Dec 10 16:39:05 2010) [sssd[be[xx]]] [sdap_fill_memberships] 
> > (7):     member #0 (CN=xx,OU=People,DC=ad,DC=smhi,DC=se): 
> > [name=xx,cn=users,cn=xx,cn=sysdb]
> > (Fri Dec 10 16:39:05 2010) [sssd[be[xx]]] [sdap_fill_memberships] 
> > (7):     member #1 (CN=xx,OU=People,DC=ad,DC=smhi,DC=se): 
> > [name=xx,cn=users,cn=xx,cn=sysdb]
> > (Fri Dec 10 16:39:05 2010) [sssd[be[xx]]] [sdap_fill_memberships] 
> > (7):     member #2 (CN=xx,OU=People,DC=ad,DC=smhi,DC=se): 
> > [name=xx,cn=users,cn=xx,cn=sysdb]
> > (Fri Dec 10 16:39:05 2010) [sssd[be[xx]]] [sdap_save_grpmem_send] (6): 
> > Storing members for group aapp
> > 
> > The users beeing added to the group aapp here in the log have both 
> > 'member' and 'memberUid' attributes, does that makes sence ?
> > 
> 
> I'm not sure what the relevance is to that statement. If you're using
> 'ldap_schema = rfc2307', then it should be adding all members that
> appear as 'memberuid' in the group.
> 
> I guess I don't understand what your question is here. It looks like
> things are behaving as expected.
> 
> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk0CYUYACgkQeiVVYja6o6Ov2wCfVRkI07wxdIu7puLxAXkse5RP
> b4oAnRaOFSPSdXh+WBzHNdDn+Ws+aecx
> =7Dz5
> -----END PGP SIGNATURE-----

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20101210/c5540c31/attachment.html>


More information about the sssd-devel mailing list