[SSSD] IPA access backend fixes (tickets #565, 567)

Sumit Bose sbose at redhat.com
Wed Jul 21 16:01:26 UTC 2010


On Wed, Jul 21, 2010 at 06:18:31PM +0400, Eugene Indenbom wrote:
> On 07/21/2010 05:46 PM, Sumit Bose wrote:
> > On Wed, Jul 21, 2010 at 04:43:41PM +0400, Eugene Indenbom wrote:
> >    
> >> The patch attached fixes issues reported in tickets #565 and 567.
> >>
> >> Eugene
> >>      
> > Hi,
> >
> > I agree with returning PAM_PERM_DENIED instead of PAM_SYSTEM_ERROR, but
> > I think you remove more entries from the cache then expected. The
> > response from the LDAP server will only contain information about the
> > local host and the current remote host (if any). If you delete anything
> > from the cache except those two (or even only one) entries the offline
> > access is largely restricted, because there is no data about other
> > remote hosts in the cache.
> >    
> No, I delete only records that match search criteria, but not returned 
> by LDAP.
> Records that are not matched (not local or remote host) are left intact.
> 
> Please read the patch more carefully.

ah, sorry, my mistake, I haven't realized that you are using the same
filter. But I still have two minor comments:

- Can you add an empty line between the header and the description of
  the patch
- I think instead of using sysdb_delete_recursive()
  sysdb_delete_entry() might be the better choice here

bye,
Sumit

> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list