[SSSD] [PATCH] AD group nesting
Jan Zeleny
jzeleny at redhat.com
Thu May 19 17:49:15 UTC 2011
Simo Sorce <simo at redhat.com> wrote:
> On Thu, 2011-05-19 at 16:21 +0200, Jakub Hrozek wrote:
> > On 05/19/2011 04:07 PM, Simo Sorce wrote:
> > > The filter is an OR
> > > filter it will always match
> >
> > Actually, it's an AND filter, something along the lines of:
> >
> > (&(cn=name)(objectclass=posixGroup)(cn=*)(gidNumber=*))
>
> I guess I was looking at the wrong part of the patch,
> this is what I was referring to:
>
> + if (gid) {
> + /* Search for users that are members of this group, or
> + * that have this group as their primary GID
> + */
> + subfilter = talloc_asprintf(tmpctx, "(|(%s=%s)(%s=%lu))",
> + SYSDB_MEMBEROF, dn,
> + SYSDB_GIDNUM, (long unsigned)
> gid);
> + } else {
> + subfilter = talloc_asprintf(tmpctx, "(%s=%s)",
> + SYSDB_MEMBEROF, dn);
> }
>
> I don't really see the need for the if/else here.
You are right, this way it makes no sense. I remember exactly the idea behind
this, but this is poor implementation on my side. Thanks for catching it.
> The other change to the filter that removes the gid part looks ok to me.
> Both GIDs and Names are unique for groups so filtering for both or for
> one of them should yield the same results and perhaps be even slightly
> faster as one less index is pulled up during the search.
>
> Simo.
Jan
More information about the sssd-devel
mailing list