[SSSD] [PATCH] Fix initgroup processing for RFC2307 (sssd-1.2)

Stephen Gallagher sgallagh at redhat.com
Fri Oct 8 11:35:54 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/08/2010 07:28 AM, Stephen Gallagher wrote:
> On 10/08/2010 03:52 AM, Jakub Hrozek wrote:
>> On 10/08/2010 02:18 AM, Stephen Gallagher wrote:
>>> Something I've been noticing during my testing: these fake groups are
>>> created with a dataExpireTimestamp of "one second ago". This means
>>> they're being reaped by the cleanup task. Is there any reason why fake
>>> groups can't just be created with dataExpireTimestamp=0 (reset when the
>>> real group is requested)?
> 
> 
>> Are they really reaped though or does the cleanup code just find them
>> because they are expired?
> 
>> Speaking in terms of what would be in the debug logs, if the cleanup
>> code finds an expired group, it outputs something like:
> 
>> DEBUG(4, ("Found %d expired group entries!\n", state->count));
> 
>> but then it goes on and checks if any users are members of these groups
>> (the filter is memberof=group_dn). If no users like this are found, we
>> really proceed with deleting the groups, if there is a memberof link, we
>> keep them. Deleting should emit a debug message such as:
> 
>> DEBUG(8, ("About to delete group %s\n", name));
> 
>> In case of initgroups, deletion should never happen as the user saved
>> during the operation should link to the group. If they are really
>> reaped, I think that is a bug.
> 
>> If we set dataExpireTimestamp=0 we would never clean the expired group,
>> even if the user entry went away until the group is refreshed and real
>> timestamps are set.
> 
> 
> Sorry, you are correct. I was only seeing things disappearing on me
> because I was in the middle of trying to debug why the group memberships
> weren't being properly added in my code. Now that my code is working
> properly, I'm not seeing the groups disappear any more :)
> 


Also, ack.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkyvAhoACgkQeiVVYja6o6MnpACeLRmaF3SmoHFQcD91Ji/Ed6Ck
mzgAmgIOwg+KryrheRJKTpZ/jZSGnp5N
=86Cp
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list