[SSSD] [PATCH] Add missing sysdb transaction to group enumerations

Stephen Gallagher sgallagh at redhat.com
Mon Jan 10 18:34:31 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/10/2011 09:00 AM, Simo Sorce wrote:
> On Fri, 07 Jan 2011 15:03:42 -0500
> Stephen Gallagher <sgallagh at redhat.com> wrote:
> 
>> This should be safe, because during an enumeration, all users
>> should now be in the sysdb, so we won't need to go back to the
>> LDAP server for missing members.
> 
> This is not necessarily true. Both bad information (non existing users
> listed as members) or filters on users (by uid) on our side can cause
> groups to have members we can't resolve locally.
> 
> I suggest we pass down a "on_enumeration" flag to these functions so
> that they will skip contactig the ldap server for any user not found
> locally.

Further investigation found that Simo was right about RFC2307bis; we
would have been wasting trips back to the LDAP server. However, on
RFC2307, we just write dummy entries locally to the sysdb. This is
actually good behavior, as it is expected (if esoteric) behavior that
RFC2307 groups can contain users that do not exist on the LDAP server.

New patch attached to address RFC2307bis.


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk0rUTcACgkQeiVVYja6o6PjAACgm45ShTPpohxxa9DNPE94jzgQ
B80An2e1Z+i8iJT1M2spTbKEScKVOsot
=lNtH
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-missing-sysdb-transaction-to-group-enumerations.patch
Type: text/x-patch
Size: 6232 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110110/794ee5f6/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-missing-sysdb-transaction-to-group-enumerations.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110110/794ee5f6/attachment.sig>


More information about the sssd-devel mailing list