[SSSD] [PATCH] Return all user members for RFC2307 groups (sssd-1.2)
Simo Sorce
ssorce at redhat.com
Tue Oct 5 21:12:35 UTC 2010
On Tue, 05 Oct 2010 19:11:02 +0200
Jakub Hrozek <jhrozek at redhat.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> [PATCH 1/3] sysdb interface for adding expired user entries
> These are added instead of looking up the members.
I am not sure I like adding a uid and gid number.
I understand it makes it simpler as you can reuse the existing sysdb
interface but it makes me really nervous, I think a fake user shouldn't
have any attribute at all including gidnumber and uidnumber so that it
is clear it is a fake user.
In any case, should we decide having uidnumber=0, gidnumber=0 is an
acceptable compromise, these shouldn't be exposed as arguments in the
sysdb interface. We should just use internal values store into a macro
like FAKE_UID_NUMBER and FAKE_GID_NUMBER.
Also if you always return ok in cleanup_users_logged_in() when uid = 0
then it means you will never clean up these entries. Am I reading it
right? If so that would be a problem. Fake users can never be logged in
so you should probably return ENOENT instead ...
> [PATCH 2/3] Shortcut for save_group() to accept sysdb DNs as member
> attributes
>
> This patch is a backport of original written by Ralf Haferkamp.
ack.
> [PATCH 3/3] Add fake users during saving of RFC2307 group
> Instead of looking up the user entries, we just add dummy expired
> users that are refreshed when they are requested with
> getpwnam/getpwuid
This looks reasonable, although a quite complex patch (due too async
sysdb unfortunately :-/).
One thing I can't see though. At the end of
sdap_process_missing_member_2307_done() you save the missing group DN
in the state->sysdb_dns[] array.
But I don't see where you use these additional names you are saving
here... I may be missing some relationship, can you shed some light ?
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list