[SSSD] [PATCH] Fix initgroup processing for RFC2307 (sssd-1.2)

Stephen Gallagher sgallagh at redhat.com
Fri Oct 8 11:28:03 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/08/2010 03:52 AM, Jakub Hrozek wrote:
> On 10/08/2010 02:18 AM, Stephen Gallagher wrote:
>> Something I've been noticing during my testing: these fake groups are
>> created with a dataExpireTimestamp of "one second ago". This means
>> they're being reaped by the cleanup task. Is there any reason why fake
>> groups can't just be created with dataExpireTimestamp=0 (reset when the
>> real group is requested)?
> 
> 
> Are they really reaped though or does the cleanup code just find them
> because they are expired?
> 
> Speaking in terms of what would be in the debug logs, if the cleanup
> code finds an expired group, it outputs something like:
> 
> DEBUG(4, ("Found %d expired group entries!\n", state->count));
> 
> but then it goes on and checks if any users are members of these groups
> (the filter is memberof=group_dn). If no users like this are found, we
> really proceed with deleting the groups, if there is a memberof link, we
> keep them. Deleting should emit a debug message such as:
> 
> DEBUG(8, ("About to delete group %s\n", name));
> 
> In case of initgroups, deletion should never happen as the user saved
> during the operation should link to the group. If they are really
> reaped, I think that is a bug.
> 
> If we set dataExpireTimestamp=0 we would never clean the expired group,
> even if the user entry went away until the group is refreshed and real
> timestamps are set.


Sorry, you are correct. I was only seeing things disappearing on me
because I was in the middle of trying to debug why the group memberships
weren't being properly added in my code. Now that my code is working
properly, I'm not seeing the groups disappear any more :)

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEUEARECAAYFAkyvAEMACgkQeiVVYja6o6PpuACVE50y2vfFzrHF9Q7i6lJP3suR
xACgnhZ5UTl3qHU1GSKTDmldTSNdBNw=
=dblt
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list