[SSSD] [PATCH] AD group nesting

Simo Sorce simo at redhat.com
Thu May 19 14:39:06 UTC 2011


On Thu, 2011-05-19 at 16:21 +0200, Jakub Hrozek wrote:
> On 05/19/2011 04:07 PM, Simo Sorce wrote:
> > The filter is an OR
> > filter it will always match 
> 
> Actually, it's an AND filter, something along the lines of:
> 
> (&(cn=name)(objectclass=posixGroup)(cn=*)(gidNumber=*))

I guess I was looking at the wrong part of the patch,
this is what I was referring to:

+        if (gid) {
+            /* Search for users that are members of this group, or
+             * that have this group as their primary GID
+             */
+            subfilter = talloc_asprintf(tmpctx, "(|(%s=%s)(%s=%lu))",
+                                        SYSDB_MEMBEROF, dn,
+                                        SYSDB_GIDNUM, (long unsigned)
gid);
+        } else {
+            subfilter = talloc_asprintf(tmpctx, "(%s=%s)",
+                                        SYSDB_MEMBEROF, dn);
         }

I don't really see the need for the if/else here.

The other change to the filter that removes the gid part looks ok to me.
Both GIDs and Names are unique for groups so filtering for both or for
one of them should yield the same results and perhaps be even slightly
faster as one less index is pulled up during the search.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list