[SSSD] [PATCH] add pysss.getgrouplist(username)

Jakub Hrozek jhrozek at redhat.com
Tue Jul 23 12:25:14 UTC 2013


On Mon, Jul 22, 2013 at 04:17:30PM +0300, Alexander Bokovoy wrote:
> On Mon, 22 Jul 2013, Jakub Hrozek wrote:
> >On Fri, Jul 19, 2013 at 07:15:34PM +0300, Alexander Bokovoy wrote:
> >>On Fri, 19 Jul 2013, Jakub Hrozek wrote:
> >>>On Fri, Jul 19, 2013 at 04:29:37PM +0300, Alexander Bokovoy wrote:
> >>>>Hi!
> >>>>
> >>>>Apparently, getgrouplist(3) call is not available in Python older than
> >>>>Python 3.3. So I agreed with Jakub to have it bound to pysss Python
> >>>>module. We need this call to obtain list of groups trusted domain user
> >>>>belongs to for HBAC testing in FreeIPA.
> >>>>
> >>>>Additionally, I've fixed bug with linking of pysss. This patch is
> >>>>relevant to 1.10 as well, while the first one is needed in sssd 1.11.
> >>>>
> >>>>
> >>>>--
> >>>>/ Alexander Bokovoy
> >>>
> >>>>Subject: [PATCH 1/2] build: fix dependencies for pysss module
> >>>Ack
> >>>
> >>>>Subject: [PATCH 2/2] pysss: add pysss.getgrouplist(username)
> >>>
> >>>I would just like to amend the doctext to make it clear that this is
> >>>just a system wrapper and not limited to users served by the sssd. See
> >>>the attached patch, I'd like to squash it before pushing.
> >>
> >>>From a4b19b4b0e5d1e9b088059fc77f01e07d2407ca0 Mon Sep 17 00:00:00 2001
> >>>From: Jakub Hrozek <jhrozek at redhat.com>
> >>>Date: Fri, 19 Jul 2013 16:52:11 +0200
> >>>Subject: [PATCH] Amend the doctext
> >>>
> >>>---
> >>>src/python/pysss.c | 2 ++
> >>>1 file changed, 2 insertions(+)
> >>>
> >>>diff --git a/src/python/pysss.c b/src/python/pysss.c
> >>>index a2924ff32575e1d41a776769720129b42de860da..6ae9a25268e632817311ff3cf0cb9354d99b5be3 100644
> >>>--- a/src/python/pysss.c
> >>>+++ b/src/python/pysss.c
> >>>@@ -751,6 +751,8 @@ fail:
> >>> */
> >>>PyDoc_STRVAR(py_sss_getgrouplist__doc__,
> >>>    "Get list of groups user belongs to.\n\n"
> >>>+    "NOTE: The interface uses the system NSS calls and is not limited to "
> >>>+    "users served by the SSSD!\n"
> >>>    ":param username: name of user to get list for\n");
> >>>
> >>>static PyObject *py_sss_getgrouplist(PyObject *self, PyObject *args)
> >>ACK.
> >>
> >
> >Squashed in the doctext fix and pushed to master. The first patch was
> >also pushed to sssd-1-10.
> You were too fast but I have another fix for the unlikely case of NSS
> modules returning group IDs that cannot be resolved back. In such case
> these group IDs need to be skipped and, as result, whole tuple needs to
> be resized.
> 
> >After a discussion on IRC with Tomas and Alexander, we found one bug in
> >IPA. I'm also checking the recent idmap changes to see if we're behaving
> >correctly.
> Yes, Tomas did send updated patch to FreeIPA list that fixed the issue.
> 
> -- 

Ack



More information about the sssd-devel mailing list