[SSSD] IPA access backend fixes (tickets #565, 567)

Eugene Indenbom eindenbom at gmail.com
Wed Jul 21 16:20:18 UTC 2010


On 07/21/2010 08:01 PM, Sumit Bose wrote:
> On Wed, Jul 21, 2010 at 06:18:31PM +0400, Eugene Indenbom wrote:
>    
>> On 07/21/2010 05:46 PM, Sumit Bose wrote:
>>      
>>> On Wed, Jul 21, 2010 at 04:43:41PM +0400, Eugene Indenbom wrote:
>>>
>>>        
>>>> The patch attached fixes issues reported in tickets #565 and 567.
>>>>
>>>> Eugene
>>>>
>>>>          
>>> Hi,
>>>
>>> I agree with returning PAM_PERM_DENIED instead of PAM_SYSTEM_ERROR, but
>>> I think you remove more entries from the cache then expected. The
>>> response from the LDAP server will only contain information about the
>>> local host and the current remote host (if any). If you delete anything
>>> from the cache except those two (or even only one) entries the offline
>>> access is largely restricted, because there is no data about other
>>> remote hosts in the cache.
>>>
>>>        
>> No, I delete only records that match search criteria, but not returned
>> by LDAP.
>> Records that are not matched (not local or remote host) are left intact.
>>
>> Please read the patch more carefully.
>>      
> ah, sorry, my mistake, I haven't realized that you are using the same
> filter. But I still have two minor comments:
>
> - Can you add an empty line between the header and the description of
>    the patch
> - I think instead of using sysdb_delete_recursive()
>    sysdb_delete_entry() might be the better choice here
>
>    
New patch is attached.

Eugene
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 0001-Fix-IPA-access-backend-handling-of-obsolete-and-miss.patch
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100721/8202ac8b/attachment.ksh>


More information about the sssd-devel mailing list