[SSSD] [PATCH] LDAP: Only convert direct parents' ghost attribute to member
Pavel Březina
pbrezina at redhat.com
Mon Nov 19 16:51:53 UTC 2012
On 11/18/2012 11:58 PM, Jakub Hrozek wrote:
> [PATCH 1/2] SYSDB: Use the add_string convenience functions for managing
> ghost user attribute
>
> Using the convenience function instead of low-level ldb calls makes the
> code more compact and more readable.
>
> [PATCH 2/2] LDAP: Only convert direct parents' ghost attribute to member
>
> https://fedorahosted.org/sssd/ticket/1612
>
> I'm not too happy with the originalDN attribute exposed in the
> sysdb_add_user/store_user functions but it seemed like a better way
> than grabbing the attribute from the extended attributes in the "attrs"
> array. At the same time, we need to adjust the attributes during all user
> adds, not just during sdap_store_user from the LDAP provider. Ideas on
> how to make the process cleaner are welcome.
>
> This patch changes the handling of ghost attributes when saving the
> actual user entry. Instead of always linking all groups that contained
> the ghost attribute with the new user entry, the original member
> attributes are now saved in the group object and the user entry is only
> linked with its direct parents.
>
> As the member attribute is compared against the originalDN of the user,
> if either the originalDN or the originalMember attributes are missing,
> the user object is linked with all the groups as a fallback.
>
> The original member attributes are only saved if the LDAP schema
> supports nesting.
> @@ -235,6 +236,19 @@ sdap_process_ghost_members(struct sysdb_attrs *attrs,
> return ret;
> }
>
Hi,
just one nitpick.
> + if (store_original_member) {
> + DEBUG(SSSDBG_TRACE_FUNC, ("The group has %d members\n", memberel->num_values));
> + for (i = 0; i < memberel->num_values; i++) {
> + ret = sysdb_attrs_add_string(sysdb_attrs, SYSDB_ORIG_MEMBER,
> + (const char *) memberel->values[i].data);
> + if (ret) {
> + DEBUG(SSSDBG_OP_FAILURE, ("Could not add member [%s]\n",
> + (const char *) memberel->values[i].data));
wrong indentation^^
> + return ret;
> + }
> + }
> + }
> +
Otherwise it looks good to me.
More information about the sssd-devel
mailing list