[SSSD] sssd-1.4.1 nested groups rfc2307bis

Stephen Gallagher sgallagh at redhat.com
Fri Nov 12 13:19:20 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/12/2010 08:13 AM, Sergei V. Kovylov wrote:
> Hello everyone.
> Can you clarify the situation about nested groups?
> When I use rfc2307bis I'm not able to get membership from nested groups.

> Example:
> GRP-SVC-SSH-NODE
> |- user1
> |- user2
> 
> GRP-SVC-SSH-NODE1
> |- GRP-SVC-SSH-NODE
> 
> 
> Users from GRP-SVC-SSH-NODE are not members of GRP-SVC-SSH-NODE1.
> 

What command are you using to check this?
Can you tell me if
getent group GRP-SVC-SSH-NODE1
shows the users from GRP-SVC-SSH-NODE?

What about:
id <user from GRP-SVC-SSH-NODE>
Does that show the user as a member of both groups?


If possible, please also turn debug_level up to 6 and include the debug
log in /var/log/sssd/sssd_<domain>.log for those two commands.


> In previous version 1.3.1 it works, but from 1.4 version it is not working.
> As I may see in "src/providers/ldap/sdap_async_accounts.c":
> 
> /* FIXME: we ignore nested rfc2307bis groups for now */
>     filter = talloc_asprintf(grp_state, "(objectclass=%s)",
>                              opts->user_map[SDAP_OC_USER].name);
> 
> 
> Also the same situation with LDAP memberOf attribute. It just create
> "originalMemberOf" entry, but do nothing with it.
> 
> Maybe the problem is because of groups are stored in different OU:
> 
> OU=COMPUTE
> |-OU=GROUP-ACCESS
>     |- cn=GRP-SVC-SSH-NODE
>     |- ou=SSH-GROUPS
>         |-cn=GRP-SVC-SSH-NODE01
> 
> which means:
> GRP-SVC-SSH-NODE =  cn=GRP-SVC-SSH-NODE,ou=GROUP-ACCESS,ou=COMPUTE, dc......
> GRP-SVC-SSH-NODE1 =
> cn=GRP-SVC-SSH-NODE1,ou=SSH-GROUPS,ou=GROUP-ACCESS,ou=COMPUTE, dc.....




- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkzdPtgACgkQeiVVYja6o6NdvACfeR/Olk3TeJcCjwaxgMq0j9xE
e5MAoJfT2onwrvyIgZw7PobGb6EhcTA0
=6lIt
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list