[SSSD] user and group precedence issue

Olivier ldap at guillard.nom.fr
Wed Mar 14 20:17:15 UTC 2012


> (without the n :-)

Ooops :)

> sssd cares only about what exists in ldap to date.

Ooops again

> If you look at the ldap tree on its own you see an
> "unknown" user name as member of a group.

Ok, I see the logic now ( although I'm not completely
convinced from a practical point of view to be honnest :
a user name could be defined somewhere else, in a
referal ldap for example. In that case, should it be an
overall group consistency problem if a memberuid was
uknown because a referal server is not accessible ? ).

Anyway, thank you so much for your responses Simo
and Stephen : I'll adapt my view to what is possible then :-)

Kindest,

---
Olivier

2012/3/14 Simo Sorce <simo at redhat.com>:
> On Wed, 2012-03-14 at 19:51 +0100, Olivier wrote:
>> Simon,
>
> (without the n :-)
>
>> that's where I don't catch ( sorry) :
>>
>> > You are asking it to know about "unknown" users
>>
>> If you say in nsswitch.conf :
>>
>> passwd: local sss
>> group: sss local
>>
>> Then sss should know about users that are in local
>> /etc/passwd and may retrieve their groups in ldap ?
>
> No, sssd is blissfully unaware of what you have in /etc/passwd
> or /etc/group, sssd cares only about what exists in ldap to date.
>
>> Why would that be inconsistent not to insert users
>> entries in ldap in that situation ?
>
> Because in the ldap server there is no corresponding user. If you look
> at the ldap tree on its own you see an "unknown" user name as member of
> a group.
>
>> BTW, I don' think that ldap requires that an entry exists
>> for a posixgroup memberuid ?
>
> No the rfc2307 schema does not mandate consistency (the rfc2307bis
> schema does mandate it due to use of DNs instead of simple names).
>
> Simo.
>
> --
> Simo Sorce * Red Hat, Inc * New York
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list