[SSSD] [PATCHES] Support native IPA netgroups

Jan Zelený jzeleny at redhat.com
Wed Nov 16 13:11:25 UTC 2011


> On Thu, 2011-11-03 at 23:22 +0100, Jan Zeleny wrote:
> > Stephen Gallagher <sgallagh at redhat.com> wrote:
> > > On Wed, 2011-10-19 at 00:42 +0200, Jan Zeleny wrote:
> > > > Jan Zelený <jzeleny at redhat.com> wrote:
> > > > > I'm sending couple patches which add support for IPA netgroups:
> > > > > 
> > > > > #53
> > > > > These routines were not static, so I renamed them in order to avoid
> > > > > confusion and possible collision with equivalent routines in IPA
> > > > > provider
> 
> Ack.
> 
> > > > > #54
> > > > > Some new config options, please focus on this patch, I'm not
> > > > > entirely sure if my approach was the correct one.
> 
> Nack.
> 
> Looks mostly good, except that when you added the new host search base
> option, you don't check it in the ipa_get_id_options() function. You
> need to make sure to set it appropriately and call
> sdap_parse_search_base().
> 
> > > > > #55
> > > > > This new context was necessary so I can pass ipa options to routine
> > > > > determining host search base.
> 
> Ack.
> 
> > > > > #56
> > > > > This is netgroups support itself
> 
> Nack.
> 
> As a nitpick, I'd prefer if you used the label 'done' in
> ipa_get_netgroups_process() instead of 'fail', since it's possible to
> reach there in the ENOENT case (which is technically a success case).
> 
> Did you test this with any netgroups that have more than one member
> triple?  Your use of sysdb_attrs_get_string() will return ERANGE if
> there is more than one of the requested attribute. You probably want to
> use sysdb_attrs_get_el() to verify whether there are any values there.
> 
> Nitpick: when you 'continue' if entities_found == 0, don't use the else
> block. Save yourself an indentation level.
> 
> Please don't use tmp_str for anything useful (like the
> sss_filter_sanitize() or the hash key). It's confusing to figure out
> which one you're sanitizing.
> 
> ipa_netgr_fetch_*() functions do not handle multiple search bases (or
> the associated filters).
> 
> get_host_search_base() should not be occurring in
> ipa_netgr_fetch_hosts(), it should be set up like users and netgroups in
> the ipa_get_id_options() function and capable of handling multiple
> search bases.
> 
> Would you please add more comments to ipa_netgr_members_process()? It's
> nicely generic, but that makes it tricky to follow.
> 
> Otherwise, I like the approach. Good work!
> 
> > > > > #57
> > > > > IPA id provider which is utilizing previously added support of
> > > > > netgroup fetching
> 
> Ack

I'm sending updated set of patches. All your comments were addressed, I also 
added man page updates and one modification to sdap_parse_search_base() which 
can be now used for at more places in IPA provider.


Thanks
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-053-2.1-Renamed-some-LDAP-routines.patch
Type: text/x-patch
Size: 10468 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111116/448ca9c2/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-053-2.2-Modified-sdap_parse_search_base.patch
Type: text/x-patch
Size: 6777 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111116/448ca9c2/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-054-3-Added-and-modified-options-for-IPA-netgroups.patch
Type: text/x-patch
Size: 17350 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111116/448ca9c2/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-055-2-New-IPA-ID-context.patch
Type: text/x-patch
Size: 8323 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111116/448ca9c2/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-056-3-Added-support-for-fetching-netgroups-in-IPA-provider.patch
Type: text/x-patch
Size: 34027 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111116/448ca9c2/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-057-2-Added-IPA-account-info-handler.patch
Type: text/x-patch
Size: 14146 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111116/448ca9c2/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111116/448ca9c2/attachment.sig>


More information about the sssd-devel mailing list