[SSSD] Ticket #1376 -- Add support for suppressing group members

Jakub Hrozek jhrozek at redhat.com
Mon Nov 12 12:12:07 UTC 2012


On Fri, Nov 09, 2012 at 08:05:02PM -0800, Paul B. Henson wrote:
> I'm attaching an initial draft of the implementation of
> ignore_group_members per ticket #1376. I still need to update the
> documentation (and some python code in SSSDConfig it looks like), but
> functionality wise this prevents ldap from requesting the member
> attribute and sssd from returning any cached members that might be left
> in the local db. As this is my first attempt at working with sssd, I
> wanted to get early feedback in case I'm doing something silly ;).
> 
> Also, regarding the comment on the ticket:
> 

Thank you for the contribution! I will take a look at the patch..can you
just send the patch as output of git format-patch in the future? It's
easier for us to handle that way.

As per the documentation and the configAPI -- you can either let us
worry about that part as we already know which parts need to be modified
or you can check out commit 1542b85f13d72329685bdd97aa879c36d11f81be,
for example. I think that patch added/changed all the correct pieces at
the correct places.

> "The trickiest piece of this functionality would be ensuring that we
> don't delete existing member/memberOf linkages from the cache during
> group lookups that were put there by previous initgroups() requests.
> Thus, when this option is in play, member/memberOf should only be
> managed by initgroups() calls."
> 
> My understanding of this is that an initgroups call will set up some
> state in the cache regarding members of groups, and a getgrnam or
> getgrgid call that skips retrieving the member attribute will wipe these
> out of the cache. 

Yes, that's my understanding, too. I think the way the code is built now
would treat the attributes as missing and delete them during a getgrnam
or getgrgid call.

> However, it's also my understanding that *every*
> initgroups call hits ldap directly to make sure stale data isn't used
> for authorization purposes. 
> If so, why do we care that the data in the
> cache, which isn't going to be used, gets wiped out? When
> ignore_group_members is enabled, the only thing that cares about group
> members is initgroups, correct?
> 

The SSSD always retrieves initgroups data during an authentication
request that comes through the PAM stack for exactly the reason you
cited. For lookups that only occur through the name-service-switch
module, the SSSD caches the data for entry_cache_user_timeout by
default.

So maybe the code could be modifed to read the existing group
memberships and fake the results it got from LDAP to also include these
memberships?



More information about the sssd-devel mailing list