[SSSD] Netgroups in SSSD

Dmitri Pal dpal at redhat.com
Fri Sep 10 13:42:55 UTC 2010


Stephen Gallagher wrote:
> On 09/08/2010 09:04 AM, Stephen Gallagher wrote:
> > I've also been thinking about how we're going to handle processing the
> > nested groups, and I think what I'm going to do is take advantage of
> > some of the nicer features of libcollection.
>
> > Internal processing of setnetgrent_send() will recursively call out a
> > subrequest to setnetgrent_send() again for each of the named nested
> > groups. The setnetgrent_recv() function will return a libcollection
> > object containing all of the results from that request (as well as any
> > additional subrequests called). When the results come back up, they can
> > be added together trivially using the col_add_collection_to_collection()
> > interface with the col_add_mode_clone mode.
>
>
> I've added some additional details about how I would like to do the
> nesting and loop detection to the wiki page. Comments welcome.
>

Sorry I am having trouble understanding this algorithm.
But may be it is because i do not understand the tevent_req interface to
the level needed here.
AFAIU the
struct tevent_req setnetgrent_send(char *netgroupname, hash_table_t
*nesting)
call will ask for the netgroups, while another call
errno_t setnetgrent_recv(tevent_req *req, struct collection **entries)
is the call that will be executed when the response from the server is
received.

The problems I have are with the item 4).
If it removes the netgroup from the hash how the hash ever grows?
It should grow when the requests and responses (!) are processed in a
nested way.
But I do not think that this is possible with the interface we have (at
least how it is described).
If the request for a netgroup sent and then the response is received and
we are processing a response and find that the netgroup has nested
netgroups what do we do?
Issue another request for the nested group? Fine but then we continue
with the processing of the parent group and would delete it from the
hash table before the result for the nested group gets back.
My point is that hash table should probably be created per setnetgrent
call and cleaned when fetching  of all nested netgroups is complete. It
should be never cleaned in the middle.

Am I missing something?

Also there is not design for the
 int innetgr(const char *netgroup, const char *host,
                   const char *user, const char *domain);

Is this intentional or just an omission?

Also I think we should have the following optimization:
Each fetched netgroup goes to the cache with a timestamp. If the
expiration is say 30 sec and there is a netgroup C nested into two
independent netgroups A and B and A is fetched and then B is fetched
before the expiration timeout of the C, then the netgroup C should be
taken from the cache rather than refetched.

Another thing that I just realized is that you create a flat result set
collection by appending nested groups rather than creating a collection
with tree structure and iterating it as a flat collection. While your
approach is probably the right one I wanted to draw attention to the
fact that the option of having a tree style collection with nested
referenced (or copied) subcollections and then traversing the tree as if
it is a flat collection is also available. I do not know if you looked
at such structure and whether it would help better if we need to do some
optimization (now or later). Just something to consider.
 

Thanks
Dmitri



More information about the sssd-devel mailing list