[SSSD] [PATCH] add pysss.getgrouplist(username)

Jakub Hrozek jhrozek at redhat.com
Tue Jul 23 12:27:04 UTC 2013


On Tue, Jul 23, 2013 at 02:25:14PM +0200, Jakub Hrozek wrote:
> On Mon, Jul 22, 2013 at 04:17:30PM +0300, Alexander Bokovoy wrote:
> > On Mon, 22 Jul 2013, Jakub Hrozek wrote:
> > >On Fri, Jul 19, 2013 at 07:15:34PM +0300, Alexander Bokovoy wrote:
> > >>On Fri, 19 Jul 2013, Jakub Hrozek wrote:
> > >>>On Fri, Jul 19, 2013 at 04:29:37PM +0300, Alexander Bokovoy wrote:
> > >>>>Hi!
> > >>>>
> > >>>>Apparently, getgrouplist(3) call is not available in Python older than
> > >>>>Python 3.3. So I agreed with Jakub to have it bound to pysss Python
> > >>>>module. We need this call to obtain list of groups trusted domain user
> > >>>>belongs to for HBAC testing in FreeIPA.
> > >>>>
> > >>>>Additionally, I've fixed bug with linking of pysss. This patch is
> > >>>>relevant to 1.10 as well, while the first one is needed in sssd 1.11.
> > >>>>
> > >>>>
> > >>>>--
> > >>>>/ Alexander Bokovoy
> > >>>
> > >>>>Subject: [PATCH 1/2] build: fix dependencies for pysss module
> > >>>Ack
> > >>>
> > >>>>Subject: [PATCH 2/2] pysss: add pysss.getgrouplist(username)
> > >>>
> > >>>I would just like to amend the doctext to make it clear that this is
> > >>>just a system wrapper and not limited to users served by the sssd. See
> > >>>the attached patch, I'd like to squash it before pushing.
> > >>
> > >>>From a4b19b4b0e5d1e9b088059fc77f01e07d2407ca0 Mon Sep 17 00:00:00 2001
> > >>>From: Jakub Hrozek <jhrozek at redhat.com>
> > >>>Date: Fri, 19 Jul 2013 16:52:11 +0200
> > >>>Subject: [PATCH] Amend the doctext
> > >>>
> > >>>---
> > >>>src/python/pysss.c | 2 ++
> > >>>1 file changed, 2 insertions(+)
> > >>>
> > >>>diff --git a/src/python/pysss.c b/src/python/pysss.c
> > >>>index a2924ff32575e1d41a776769720129b42de860da..6ae9a25268e632817311ff3cf0cb9354d99b5be3 100644
> > >>>--- a/src/python/pysss.c
> > >>>+++ b/src/python/pysss.c
> > >>>@@ -751,6 +751,8 @@ fail:
> > >>> */
> > >>>PyDoc_STRVAR(py_sss_getgrouplist__doc__,
> > >>>    "Get list of groups user belongs to.\n\n"
> > >>>+    "NOTE: The interface uses the system NSS calls and is not limited to "
> > >>>+    "users served by the SSSD!\n"
> > >>>    ":param username: name of user to get list for\n");
> > >>>
> > >>>static PyObject *py_sss_getgrouplist(PyObject *self, PyObject *args)
> > >>ACK.
> > >>
> > >
> > >Squashed in the doctext fix and pushed to master. The first patch was
> > >also pushed to sssd-1-10.
> > You were too fast but I have another fix for the unlikely case of NSS
> > modules returning group IDs that cannot be resolved back. In such case
> > these group IDs need to be skipped and, as result, whole tuple needs to
> > be resized.
> > 
> > >After a discussion on IRC with Tomas and Alexander, we found one bug in
> > >IPA. I'm also checking the recent idmap changes to see if we're behaving
> > >correctly.
> > Yes, Tomas did send updated patch to FreeIPA list that fixed the issue.
> > 
> > -- 
> 
> Ack

Pushed to master.



More information about the sssd-devel mailing list