[SSSD] IPA access backend fixes (tickets #565, 567)

Sumit Bose sbose at redhat.com
Thu Jul 22 07:40:34 UTC 2010


On Wed, Jul 21, 2010 at 08:20:18PM +0400, Eugene Indenbom wrote:
> On 07/21/2010 08:01 PM, Sumit Bose wrote:
> >On Wed, Jul 21, 2010 at 06:18:31PM +0400, Eugene Indenbom wrote:
> >>On 07/21/2010 05:46 PM, Sumit Bose wrote:
> >>>On Wed, Jul 21, 2010 at 04:43:41PM +0400, Eugene Indenbom wrote:
> >>>
> >>>>The patch attached fixes issues reported in tickets #565 and 567.
> >>>>
> >>>>Eugene
> >>>>
> >>>Hi,
> >>>
> >>>I agree with returning PAM_PERM_DENIED instead of PAM_SYSTEM_ERROR, but
> >>>I think you remove more entries from the cache then expected. The
> >>>response from the LDAP server will only contain information about the
> >>>local host and the current remote host (if any). If you delete anything
> >>>from the cache except those two (or even only one) entries the offline
> >>>access is largely restricted, because there is no data about other
> >>>remote hosts in the cache.
> >>>
> >>No, I delete only records that match search criteria, but not returned
> >>by LDAP.
> >>Records that are not matched (not local or remote host) are left intact.
> >>
> >>Please read the patch more carefully.
> >ah, sorry, my mistake, I haven't realized that you are using the same
> >filter. But I still have two minor comments:
> >
> >- Can you add an empty line between the header and the description of
> >   the patch
> >- I think instead of using sysdb_delete_recursive()
> >   sysdb_delete_entry() might be the better choice here
> >
> New patch is attached.

Patch is working as expected, sorry for the noise.

ACK

bye,
Sumit

> 
> Eugene



More information about the sssd-devel mailing list