[SSSD] [PATCH] Require existence of GID number in group searches

Stephen Gallagher sgallagh at redhat.com
Mon Mar 14 14:00:12 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/11/2011 10:51 AM, Sumit Bose wrote:
> On Fri, Mar 11, 2011 at 05:56:57AM -0500, Stephen Gallagher wrote:
> This is most commonly seen with ActiveDirectory?. The 'group'
> objectClass does not have a mandatory GID attribute, and SSSD was
> throwing errors when trying to process groups without them (which is
> necessary for use on a POSIX system).
> 
> This patch updates the group filters so that we include "gidNumber=*" to
> filter out groups that are missing this information.
> 
>> Although it is quite elegant to let the server do the work I wonder if
>> we shouldn't read all groups and let sssd do the checks. This way we can
>> give detailed debug messages and maybe reduce the number of bug reports.
> 
>> Maybe we should add the name of the group to this check too and a check
>> for user id and user name, just to be on the safe side.
> 
>> bye,
>> Sumit
> 
> 
> Fixes https://fedorahosted.org/sssd/ticket/824


After some discussion in IRC, we decided that the correct behavior is to
skip groups that are missing mandatory arguments to play better with
ActiveDirectory. The new version of the patch now checks for both group
ID and group name.

Also, I've added a second patch to mandate username, UID and GID for
users during enumeration as well. There's no need to restrict this for
non-enumerated lookups, as users are always queried directly via
username or gid, and would thus benefit from the existing failure
logging if the requested user was missing attributes.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1+H2gACgkQeiVVYja6o6NDVACgkjXklSiaA+n8iSobaICZeUNB
LM8Aniz9qiGSVQUi3wmRnbrSwxyCBDnl
=Z5WU
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Require-existence-of-GID-number-and-name-in-group-se.patch
Type: text/x-patch
Size: 7386 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110314/99394034/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Require-existence-of-username-uid-and-gid-for-user-e.patch
Type: text/x-patch
Size: 2754 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110314/99394034/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Require-existence-of-GID-number-and-name-in-group-se.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110314/99394034/attachment.sig>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Require-existence-of-username-uid-and-gid-for-user-e.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110314/99394034/attachment-0001.sig>


More information about the sssd-devel mailing list