[SSSD] [PATCH] NSS: invalidate memcache user entry on initgr, too

Jakub Hrozek jhrozek at redhat.com
Thu Jan 17 10:48:25 UTC 2013


On Wed, Jan 16, 2013 at 10:54:43AM -0500, Simo Sorce wrote:
> On Tue, 2013-01-15 at 15:23 +0100, Jakub Hrozek wrote:
> > On Tue, Jan 15, 2013 at 08:27:32AM -0500, Simo Sorce wrote:
> > > On Tue, 2013-01-15 at 09:02 +0100, Jakub Hrozek wrote:
> > > > https://fedorahosted.org/sssd/ticket/1757
> > > > 
> > > > When the user entry was missing completely after initgroups, we would
> > > > never invalidate the user entry from cache. This led to dangling cache
> > > > entried in memory cache if the user was removed from the server while
> > > > still being in memory cache.
> > > 
> > > 0001: Why are we unconditionally deleting the user from the memory cache
> > > even if just groups changed ?
> > > 
> > 
> > I was trying to keep the flow as simple as possible because I think that
> > user deletes or even group modifications updates on the server are so rare
> > that if we loose the memcache, it's not a big deal.
> > 
> > But I moved the user update separately in this version.
> > 
> > > 0002: Please add a comment in be_initgroups_prereq() that the first id
> > > it he user's primary gid and 'might' be duplicated later ?
> > 
> > Done
> > 
> > > Also why do we skip verifying the primary gid ?
> > > 
> > 
> > Ah, not sure, I think I was just copying the previous flow that skipped
> > the primary gid too. The attached version checks them all.
> > 
> > Thank you for the review.
> 
> Looks good to me, ACK!
> 
> Simo.

Pushed to master and sssd-1-9



More information about the sssd-devel mailing list