[SSSD] [PATCH] Every time use permissive control in function memberof_mod.

Lukas Slebodnik lslebodn at redhat.com
Tue Jul 16 13:01:31 UTC 2013


ehlo,

Group structure is described in ticket https://fedorahosted.org/sssd/ticket/1846
Please ensure that sysdb cache is empty.

call command "getent group cyclegroup1"

sssd_be will call following function:
a) sdap_store_group_with_gid (name:cyclegroup1)
   --added attributes [ ghost: user1, origMember: user1, ... ]
b) sdap_store_group_with_gid (name:cyclegroup2)
   --added attributes [ ghost: user2, origMember: user2, ... ]
c) sdap_save_grpmem (name:cyclegroup1)
   --added attributes [ member:cyclegroup2, ... ]
d) sdap_save_grpmem (name:cyclegroup2)
   --added attributes [ member:cyclegroup1, ... ]

Subtransaction "d)"  will fail and log file contains:
[ldb] (0x4000): will add 2 ghost users to 1 parents
... snip ...
[ldb] (0x4000): cancel ldb transaction (nesting: 2)
[sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Attribute or value exists]
[sysdb_set_entry_attr] (0x0400): Error: 17 (File exists)
[sysdb_store_group] (0x0400): Error: 17 (File exists)
[sdap_save_grpmem] (0x0040): Failed to save user cyclegroup2
[sdap_save_groups] (0x0040): Failed to store group 1 members.
[ldb] (0x4000): commit ldb transaction (nesting: 1)
[ldb] (0x4000): commit ldb transaction (nesting: 0)

Attached patch should fix this bug.

LS
-------------- next part --------------
>From d266b1c412731d6cbca18228a32f48017efbf3aa Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Mon, 15 Jul 2013 11:00:04 +0200
Subject: [PATCH] Every time use permissive control in function memberof_mod.

Storing cyclic groups into sysdb can cause adding ghost members,
which has already been stored. Function ldb_modify will fail
with error [Attribute or value exists].

With permisive control, duplicated attributes will be skipped
as if it was never added.

https://fedorahosted.org/sssd/ticket/1846
---
 src/ldb_modules/memberof.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/ldb_modules/memberof.c b/src/ldb_modules/memberof.c
index 4a9328482b1d3999ea0f57051249dfe5415b995f..79b33137b5ac45bda4bb5fc7efce4553f7227fe3 100644
--- a/src/ldb_modules/memberof.c
+++ b/src/ldb_modules/memberof.c
@@ -1135,6 +1135,13 @@ static int mbof_add_muop(struct mbof_add_ctx *add_ctx)
         return ret;
     }
 
+    ret = ldb_request_add_control(mod_req, LDB_CONTROL_PERMISSIVE_MODIFY_OID,
+                                  false, NULL);
+    if (ret != LDB_SUCCESS) {
+        talloc_free(mod_req);
+        return ret;
+    }
+
     return ldb_next_request(ctx->module, mod_req);
 }
 
-- 
1.8.3.1



More information about the sssd-devel mailing list