[SSSD] Handling nested netgroups (looking for recommendations)

Petter Reinholdtsen pere at hungry.com
Mon Oct 4 11:38:44 UTC 2010


[Jeff Schroeder]
> Not for the sake of being argumentative, but for the sake of
> completeness, why do you want to change the semantics of what an
> admin would expect? Especially when most people using sssd are
> former pam_ldap users and expect things like netgroups to work a
> certain way?  While not disagreeing, I'm just curious as to the
> reasoning.

We use netgroups in NIS and LDAP here at the University of Oslo, and
we expect netgroups to behave as they always have, no matter the
supplier (nis, ldap or sss :).

I use netgroups in /etc/netgroups when I need to debug stuff, to be
able to quickly change their values before pushing the final version
into our admin too (which is used to populate NIS and LDAP).  So to
me, it would be a surprise if /etc/nsswitch.conf was ignored when it
come to netgroup sources and glibc was not the one in charge of
expanding recursive netgroups.  If I did not want to consult local
files, I would list 'netgroup: sss' instead of 'netgroup files sss' in
nsswitch.conf. :)

Happy hacking,
-- 
Petter Reinholdtsen




More information about the sssd-devel mailing list