[SSSD] [PATCH] Use fake groups during IPA initgroups

Jakub Hrozek jhrozek at redhat.com
Tue Mar 22 17:36:48 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Fixes:
https://fedorahosted.org/sssd/ticket/822

[PATCH 1/2] Add originalDN to fake groups
Since we are storing expired groups during initgroups now and some of
the group processing routines depend on originalDN, I think the
originalDN should be stored with the fake groups.

This would help for instance sdap_nested_group_process_step() which
would find the expired group in sysdb and refresh it immediately instead
of trying blind lookup for users and then groups.

[PATCH 2/2] Use fake groups during IPA schema initgroups
Do not just store non-expired groups from LDAP during initgroups and
risks that some of the members might not be there. Instead, add fake
groups for those that are not yet cached and build correct
member/memberof relationship.

There's one more optimization I'd like to make, although I'm not sure if
it is 1.5 material. Since we do not fetch the memberof attribute for
LDAP groups, we must look at all groups when searching for direct
parents for a group (see sdap_initgr_nested_get_direct_parents()).

Having the memberof attribute would allow for an optimization where we
would first filter all parents and then just the direct ones. That would
be very similar to what we can do for the user since we search the
groups based on users' memberof anyway.

	Jakub
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk2I3jAACgkQHsardTLnvCX8hgCfVx56mnPQmPwMzc6QgfHp8H4R
B/UAniN3Ki/BpTyZu3rg3pBD537xrsoC
=jVyP
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-originalDN-to-fake-groups.patch
Type: text/x-patch
Size: 4216 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110322/81b5f229/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Use-fake-groups-during-IPA-schema-initgroups.patch
Type: text/x-patch
Size: 23295 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110322/81b5f229/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-originalDN-to-fake-groups.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110322/81b5f229/attachment.sig>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Use-fake-groups-during-IPA-schema-initgroups.patch.sig
Type: application/pgp-signature
Size: 71 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110322/81b5f229/attachment-0001.sig>


More information about the sssd-devel mailing list