[SSSD] Behaviour of getgrnam/getgrgid
Dmitri Pal
dpal at redhat.com
Fri Sep 10 17:39:50 UTC 2010
[snip]
>>> 4) Add marking to the objects. "Complete" mark is put on the user
>>> object when all groups he is a member of are fetched. The groups
>>> that were fetched and were not in the cache are marked as
>>> "incomplete".
>>>
>> This is only on initgroups calls, and I think the first part (properly
>> marking the user) is already implemented, we only need to mark the
>> groups differently.
>>
>>
>>> When the group members are enumerated for a group all users for a
>>> group should be fetched and "group" should be marked as "complete",
>>> users fetched by this lookup that were not in the cache are marked
>>> as "incomplete".
>>>
> Why? Or do you mean incomplete wrt to the initgroups() call for that
> user.
>
>
>> I think we could manage by simply marking users as expired, although
>> this may cause issues if we go offline, as we do not have uid/gid and
>> other fields ... probably we can simply leave those fields off, and
>> this will automatically make them "incomplete". We would have to make
>> sure the rest of the code can cope (and filter out) these users when
>> we are offline.
>>
> Are you talking about the rfc2307 case, were "dummy" user object could be
> created? In the other cases (IPA, rfc2307bis) the complete user objects
> (including gid, uid,...) should be read from LDAP IMO. Reading only a
> subset there has no real advantage IMO.
>
Incomplete user is the user that is fully fetched as user entry but the
list of the groups he is a member of is not fetched.
This makes sense for the cases when there is no memberOf and we do not
want for each user in a group go fetch all the groups this user is a
member of.
We already had a performance issue with this approach and we had to fix
it recently. If memberOf is present we can already mark it as complete.
I am not talking about reading parts of user object.
Group is complete is we know all its members. User is complete if we
know all groups he is a member of.
This is how I define completeness in this context. Sorry for confusion.
--
Thank you,
Dmitri Pal
Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
More information about the sssd-devel
mailing list