[SSSD] user and group precedence issue
Simo Sorce
simo at redhat.com
Wed Mar 14 19:40:22 UTC 2012
On Wed, 2012-03-14 at 19:51 +0100, Olivier wrote:
> Simon,
(without the n :-)
> that's where I don't catch ( sorry) :
>
> > You are asking it to know about "unknown" users
>
> If you say in nsswitch.conf :
>
> passwd: local sss
> group: sss local
>
> Then sss should know about users that are in local
> /etc/passwd and may retrieve their groups in ldap ?
No, sssd is blissfully unaware of what you have in /etc/passwd
or /etc/group, sssd cares only about what exists in ldap to date.
> Why would that be inconsistent not to insert users
> entries in ldap in that situation ?
Because in the ldap server there is no corresponding user. If you look
at the ldap tree on its own you see an "unknown" user name as member of
a group.
> BTW, I don' think that ldap requires that an entry exists
> for a posixgroup memberuid ?
No the rfc2307 schema does not mandate consistency (the rfc2307bis
schema does mandate it due to use of DNs instead of simple names).
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list