[SSSD] [PATCH] AD group nesting

Jan Zeleny jzeleny at redhat.com
Thu May 19 17:49:15 UTC 2011


Simo Sorce <simo at redhat.com> wrote:
> On Thu, 2011-05-19 at 16:21 +0200, Jakub Hrozek wrote:
> > On 05/19/2011 04:07 PM, Simo Sorce wrote:
> > > The filter is an OR
> > > filter it will always match
> > 
> > Actually, it's an AND filter, something along the lines of:
> > 
> > (&(cn=name)(objectclass=posixGroup)(cn=*)(gidNumber=*))
> 
> I guess I was looking at the wrong part of the patch,
> this is what I was referring to:
> 
> +        if (gid) {
> +            /* Search for users that are members of this group, or
> +             * that have this group as their primary GID
> +             */
> +            subfilter = talloc_asprintf(tmpctx, "(|(%s=%s)(%s=%lu))",
> +                                        SYSDB_MEMBEROF, dn,
> +                                        SYSDB_GIDNUM, (long unsigned)
> gid);
> +        } else {
> +            subfilter = talloc_asprintf(tmpctx, "(%s=%s)",
> +                                        SYSDB_MEMBEROF, dn);
>          }
> 
> I don't really see the need for the if/else here.

You are right, this way it makes no sense. I remember exactly the idea behind 
this, but this is poor implementation on my side. Thanks for catching it.

> The other change to the filter that removes the gid part looks ok to me.
> Both GIDs and Names are unique for groups so filtering for both or for
> one of them should yield the same results and perhaps be even slightly
> faster as one less index is pulled up during the search.
> 
> Simo.

Jan



More information about the sssd-devel mailing list