[SSSD] sssd nested groups and users.

Dmitri Pal dpal at redhat.com
Thu Mar 3 17:12:32 UTC 2011


On 03/03/2011 10:43 AM, Sergei V. Kovylov wrote:
> Hi All.
> It looks like I found another bug in sssd(latest git version).
> As I wrote previously we are in proccess of migration from FDS v.1.2.3
> to latest stable version and I see strange behaviour if group is a
> member of another group and has the same member as parent one and
> returns from ldap as second entry (first entry is user) then sssd
> doesn't show the rest of memebers in parent group.
> For example:
> cn=GROUP1,ou=groups,dc=domain:
> uniquemember: uid=user1,ou=users1,dc=domain
> uniquemember: uid=user1,ou=users2,dc=domain
> uniquemember: uid=user1,ou=users2,dc=domain

It looks like you did some substitutions of the real users in the mail.
Are you sure that the examples you sent correctly reflect the actual
situation?
The example as written does not make much sense.


> cn=GROUP2,ou=groups,dc=domain:
> uniquemember: uid=user1,ou=users1,dc=domain
> uniquemember: cn=GROUP1,ou=groups,dc=domain
>
> In this case sssd never sets  all users in GROUP1, except user1, as
> members of GROUP2.
> BUT, if we have
> cn=GROUP1,ou=groups,dc=domain:
> uniquemember: uid=user1,ou=users1,dc=domain
> uniquemember: uid=user1,ou=users2,dc=domain
> uniquemember: uid=user1,ou=users2,dc=domain
>
> cn=GROUP2,ou=groups,dc=domain:
> uniquemember: cn=GROUP1,ou=groups,dc=domain
> uniquemember: uid=user1,ou=users1,dc=domain
>
> Then everything is correct.
> I'm still exploring this issue, but, as I'm not a developer of ssd, it
> takes some time to understand all internal mechanisms. So maybe you
> know about it already and have some steps to solve it.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel


Let me rephrase the use case:
1) There is a Group1 that has users u1,u2,u3,...
2) There is a Group2 that has users u1,...
3) Group2 is nested into Group1
4) Issue: if while processing Group 1 the nested group Group 2 not
processed first (before other users) then users from Group 2 are not
seen. If the Group 2 happens to be processed before other users in Group
1 then all members of Group 1 are shown correctly.
 
Right?

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list