[SSSD] [PATCHES][PRELIMINARY] Support for multiple LDAP search bases

Stephen Gallagher sgallagh at redhat.com
Wed Sep 28 14:41:58 UTC 2011


On Mon, 2011-09-26 at 10:22 +0200, Jakub Hrozek wrote:
> On Sun, Sep 25, 2011 at 10:27:23AM -0400, Stephen Gallagher wrote:
> > This patch I'm not 100% sure of. It may need more processing. With
> > RFC2307, it was safe to have duplicate groups in the list, because only
> > the group name is important (and we guarantee that the name list has
> > only unique values before saving it). With RFC2307bis, I'm not sure if
> > it's safe to add two groups that may have the same name. Comments
> > welcome.
> 
> I don't think it is safe to add two groups with the same name. At least
> the nss provider would choke on that during sysdb_getgrnam()


After a discussion with Simo and Nalin on #sssd today, we determined
that the multiple search base code will not (really, cannot) support
"overrides". If the same group appears in more than one base, we're
going to have to consider it a misconfiguration. We'll do our best to
handle it, but there are no guarantees.

So I'm going to add details about this to the manpage and resubmit these
patches.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110928/4f2c71c8/attachment.sig>


More information about the sssd-devel mailing list