[SSSD] [PATCHES] Handle nested groups in RFC2307bis (sssd-1-2)

Jakub Hrozek jhrozek at redhat.com
Thu Oct 7 13:14:05 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/06/2010 05:48 PM, Stephen Gallagher wrote:
> These patches apply atop Jakub's "Fix initgroup processing for RFC2307
> (sssd-1.2)" patches.
> 
> Patch 0002: Add option to limit nested groups
> 

Is the ldap_memberof_support option going to be used in any of the later
patches? It doesn't seem to be used in 0003. With IPA backend it was
also causing some weirdness (I guess b/c the indexes are out of sync):

[sssd[be[IDM.LAB.BOS.REDHAT.COM]]] [_dp_opt_get_int] (0):
[sdap_nested_group_process_send] Requested type 'Number' for option
'ldap_memberof_support' but value is of type 'String'!

ldap_group_nesting_level is not present in documentation or the
SSSDConfigAPI (the latter is probably OK at this point since the only
user is authconfig).

> Patch 0003: Handle nested groups in RFC2307bis
> 
> This first approach handles the non-optimized "pure" RFC2307bis
> case. It recursively calls into nested groups until it it has
> found them all or hits the pre-defined nesting limit.
> 
> It then saves all member users first, then all groups to the sysdb
> 
> 
> This patch only handles the general case of RFC2307bis nested groups. It
> contains no optimizations for memberOf implementations. Given that we
> have time constraints, this patch should handle all implementations of
> RFC2307bis correctly (if not high-performance).
> 
> Support for partial (AD) and complete (IPA) memberOf will be added to
> the master branch later.
> 
> 
> Still to do: initgroups for RFC2307bis using Jakub's fake groups.
> 

So far I only read the patch, not tested much, I think it looks
good..I'll provide more feedback after I test it :-)

I only have one question so far: why the memory hierarchy between
user_hash and group_hash in sdap_get_groups_process(), and then using
group_hash as mem_ctx of sdap_nested_group_process_send()?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkytx50ACgkQHsardTLnvCVFTwCgsiFgVQQS/5GsJx1Z2lfRymWs
dXsAn2BeP6Vo6tF1Nzi/JJW36LY1bMFy
=7Z0A
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list