[SSSD] [PATCH] Add missing sysdb transaction to group enumerations

Stephen Gallagher sgallagh at redhat.com
Fri Jan 14 14:00:53 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/12/2011 12:30 PM, Sumit Bose wrote:
> On Mon, Jan 10, 2011 at 01:34:31PM -0500, Stephen Gallagher wrote:
> On 01/10/2011 09:00 AM, Simo Sorce wrote:
>>>> On Fri, 07 Jan 2011 15:03:42 -0500
>>>> Stephen Gallagher <sgallagh at redhat.com> wrote:
>>>>
>>>>> This should be safe, because during an enumeration, all users
>>>>> should now be in the sysdb, so we won't need to go back to the
>>>>> LDAP server for missing members.
>>>>
>>>> This is not necessarily true. Both bad information (non existing users
>>>> listed as members) or filters on users (by uid) on our side can cause
>>>> groups to have members we can't resolve locally.
>>>>
>>>> I suggest we pass down a "on_enumeration" flag to these functions so
>>>> that they will skip contactig the ldap server for any user not found
>>>> locally.
> 
> Further investigation found that Simo was right about RFC2307bis; we
> would have been wasting trips back to the LDAP server. However, on
> RFC2307, we just write dummy entries locally to the sysdb. This is
> actually good behavior, as it is expected (if esoteric) behavior that
> RFC2307 groups can contain users that do not exist on the LDAP server.
> 
> New patch attached to address RFC2307bis.
> 
>> ok, the extra LDAP search for a not existing user is gone
> 
>> ACK

Pushed to master.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk0wVxUACgkQeiVVYja6o6NNIACeKSVIO1HcB5KDMGPBA9+AeCyU
xS8An2eaggW9wTAC2oL1K6yfZYaMtJZZ
=DrQO
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list