[SSSD] [PATCH] Add missing sysdb transaction to group enumerations

Sumit Bose sbose at redhat.com
Wed Jan 12 17:30:51 UTC 2011


On Mon, Jan 10, 2011 at 01:34:31PM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 01/10/2011 09:00 AM, Simo Sorce wrote:
> > On Fri, 07 Jan 2011 15:03:42 -0500
> > Stephen Gallagher <sgallagh at redhat.com> wrote:
> > 
> >> This should be safe, because during an enumeration, all users
> >> should now be in the sysdb, so we won't need to go back to the
> >> LDAP server for missing members.
> > 
> > This is not necessarily true. Both bad information (non existing users
> > listed as members) or filters on users (by uid) on our side can cause
> > groups to have members we can't resolve locally.
> > 
> > I suggest we pass down a "on_enumeration" flag to these functions so
> > that they will skip contactig the ldap server for any user not found
> > locally.
> 
> Further investigation found that Simo was right about RFC2307bis; we
> would have been wasting trips back to the LDAP server. However, on
> RFC2307, we just write dummy entries locally to the sysdb. This is
> actually good behavior, as it is expected (if esoteric) behavior that
> RFC2307 groups can contain users that do not exist on the LDAP server.
> 
> New patch attached to address RFC2307bis.

ok, the extra LDAP search for a not existing user is gone

ACK

bye,
Sumit

> 
> 
> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk0rUTcACgkQeiVVYja6o6PjAACgm45ShTPpohxxa9DNPE94jzgQ
> B80An2e1Z+i8iJT1M2spTbKEScKVOsot
> =lNtH
> -----END PGP SIGNATURE-----



More information about the sssd-devel mailing list