[SSSD] [PATCH] Use fake groups during IPA initgroups

Jakub Hrozek jhrozek at redhat.com
Tue Mar 22 18:35:08 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/22/2011 06:36 PM, Jakub Hrozek wrote:
> Fixes:
> https://fedorahosted.org/sssd/ticket/822
> 
> [PATCH 1/2] Add originalDN to fake groups
> Since we are storing expired groups during initgroups now and some of
> the group processing routines depend on originalDN, I think the
> originalDN should be stored with the fake groups.
> 
> This would help for instance sdap_nested_group_process_step() which
> would find the expired group in sysdb and refresh it immediately instead
> of trying blind lookup for users and then groups.
> 
> [PATCH 2/2] Use fake groups during IPA schema initgroups
> Do not just store non-expired groups from LDAP during initgroups and
> risks that some of the members might not be there. Instead, add fake
> groups for those that are not yet cached and build correct
> member/memberof relationship.
> 
> There's one more optimization I'd like to make, although I'm not sure if
> it is 1.5 material. Since we do not fetch the memberof attribute for
> LDAP groups, we must look at all groups when searching for direct
> parents for a group (see sdap_initgr_nested_get_direct_parents()).
> 
> Having the memberof attribute would allow for an optimization where we
> would first filter all parents and then just the direct ones. That would
> be very similar to what we can do for the user since we search the
> groups based on users' memberof anyway.
> 
> 	Jakub

Attached patches are rebased on top of Stephen's multiname patches.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk2I69wACgkQHsardTLnvCXl3ACgjSoWl+ojEYLcvyEzZ0o+nEvm
A30AoMSN6kjoEQ4EX8gO+GTmk8vzOnhN
=WYTs
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-originalDN-to-fake-groups.patch
Type: text/x-patch
Size: 4216 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110322/e5d267a5/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Use-fake-groups-during-IPA-schema-initgroups.patch
Type: text/x-patch
Size: 23706 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110322/e5d267a5/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-originalDN-to-fake-groups.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110322/e5d267a5/attachment.sig>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Use-fake-groups-during-IPA-schema-initgroups.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110322/e5d267a5/attachment-0001.sig>


More information about the sssd-devel mailing list