[SSSD] sssd-1.4.1 nested groups rfc2307bis

Stephen Gallagher sgallagh at redhat.com
Tue Nov 16 17:56:27 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/16/2010 12:03 PM, Stephen Gallagher wrote:
> On 11/12/2010 11:01 AM, Sergei V. Kovylov wrote:
>> Stephen, you are right 1.3.1 is working version too.
>> I have made some experiment and found out that:
>> 1. The behaviour of sssd (1.3.1) depends on how to create OU on LDAP
>> server. If OU with groups is created after all  users' OUs  then sssd
>> gets everything correctly.
>> Example:
>> correct sequence:
>> ou=MCC (users)
>> ou=HMC (users)
>> ou=GROUP-ACCESS (groups)
> 
>> incorrect sequence:
>> ou=GROUP-ACCESS (groups)
>> ou=MCC (users)
>> ou=HMC (users)
> 
>> 2. sssd 1.4.x doesn't work even with correct sequence of OU creation
>> (see above).
>> 3. if I remove GRP-SVC-SSH-NODE from GRP-SVC-SSH-NODE  and recreate
>> membership back then sssd will see members of GRP-SVC-SSH-NODE in
>> GRP-SVC-SSH-NODE group but untill new installation or reinstallation
>> of sssd.
> 
> 
> 
> Sorry it's taken me so long to reply. I've been able to reproduce the
> problem and I'm working on fixing it right now.
> 
> I have opened https://fedorahosted.org/sssd/ticket/683 to track the problem.
> 


I take that back. I had a misconfiguration in my environment that was
falsely giving me the wrong information.

I'm now actually pretty certain that you're hitting bug
https://fedorahosted.org/sssd/ticket/663

What's happening is that our cleanup task (that makes sure the cache
doesn't grow excessively large containing unused entries) is incorrectly
cleaning out groups that only contain other groups (and no direct users).

This will be fixed in 1.5.0. (I will probably also backport the patch to
1.4.x in Fedora)

As an interim solution, please update to sssd-1.4.1-2.fc14 in
updates-testing -
https://admin.fedoraproject.org/updates/sssd-1.4.1-2.fc14 - and add:

ldap_purge_cache_timeout = 0

To your [domain/MD.METEORF.RU] section of sssd.conf.


If you're not using the Fedora binaries and are instead building your
own copies, please cherry-pick the following patch:

commit 4f5824cf9b80dede79a6eddbcbb48f4ac75e5de4
Author: Stephen Gallagher <sgallagh at redhat.com>
Date:   Tue Nov 2 07:46:13 2010 -0400

    Properly document ldap_purge_cache_timeout

    Also allow it to be disabled entirely


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkzixcsACgkQeiVVYja6o6PK0QCfcx42Wea3jpJPwT4ywoPD7+87
pCcAoJ7sbOaXqNrJ/UyGZIuXdR//kRvJ
=Vnlx
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list