[SSSD] [PATCH] LDAP: Use primary cn to search netgroup

Lukas Slebodnik lslebodn at redhat.com
Mon Sep 16 11:13:28 UTC 2013


On (16/09/13 12:24), Pavel Březina wrote:
>On 09/16/2013 12:15 PM, Jakub Hrozek wrote:
>>On Mon, Sep 16, 2013 at 11:01:36AM +0200, Pavel Březina wrote:
>>>On 09/13/2013 04:52 PM, Lukas Slebodnik wrote:
>>>>ehlo,
>>>>
>>>>Attached patch resolves ticket #2075
>>>>
>>>>LS
>>>
>>>Hi,
>>>minor nack.
>>>
>>>>+    ret = sdap_get_netgroup_primary_name(memctx, opts, attrs, dom, &name);
>>>>+    if (ret != EOK) {
>>>>+        DEBUG(SSSDBG_OP_FAILURE, ("Failed to get netgroup name\n"));
>>>>+            goto fail;
>>>>+        }
>>>
>>>Wrong indentation ^^ otherwise LGTM
>>>
>>>Can you provide steps to reproduce please? I tries following netgroups:
>>>
>>>dn: cn=ng-1,ou=Netgroups,dc=ldap,dc=pb
>>>objectClass: top
>>>objectClass: nisNetgroup
>>>cn: ng-1
>>>cn: ng-3
>>>nisNetgroupTriple: (,,bobby,example.com)
>>>nisNetgroupTriple: (,,johny.example.com)
>>
>>Would it trigger the bug if you reversed the order of the cn attributes?
>>Or would that make saving the netgroup fail in sssd_be?
>
>Reversing the order of cn attributes did not help but I triggered the
>bug when dn=cn=ng-1 had only one cn, but dn=ng-3 had cn=ng-3 and
>cn=ng-1.

The same result should be also without patch.

BTW It is a misconfiguration, if you use the same cn in two different entries.

Original problem was that the same netrgoup was stored to ldb
with the first cn attribute and later with the second cn attribute.

LS



More information about the sssd-devel mailing list