[SSSD] [PATCH] LDAP: retain external members

Lukas Slebodnik lslebodn at redhat.com
Wed Dec 10 15:11:29 UTC 2014


On (10/12/14 10:44), Pavel Reichl wrote:
>
>On 12/09/2014 01:36 PM, Sumit Bose wrote:
>>On Tue, Nov 25, 2014 at 03:42:14PM +0100, Pavel Reichl wrote:
>>>Hello,
>>>
>>>please see attached patch for https://fedorahosted.org/sssd/ticket/2492
>>>
>>>Thanks!
>>Hi Pavel,
>>
>>thank you for the patch, it works well in my tests and I didn't see any
>>regressions in IPA setup with and without trsut to AD, so ACK.
>>
>>I would just like to ask you to add a comment to
>>
>>>@@ -842,6 +913,23 @@ static int sdap_save_grpmem(TALLOC_CTX *memctx,
>>>              goto fail;
>>>          }
>>>      }
>>>+    if (opts->schema_type == SDAP_SCHEMA_IPA_V1) {
>>>+        ret = sysdb_attrs_get_string(attrs, SYSDB_SID_STR, &group_sid);
>>>+        if (ret != EOK) {
>>>+            DEBUG(SSSDBG_TRACE_FUNC, "Failed to get group sid\n");
>>>+            group_sid = NULL;
>>>+        }
>>>+
>>>+        if (group_sid != NULL) {
>>>+            ret = retain_extern_members(memctx, dom, group_name, group_sid,
>>>+                                        &userdns, &nuserdns);
>>>+            if (ret != EOK) {
>>>+                DEBUG(SSSDBG_MINOR_FAILURE,
>>>+                      "retain_extern_members failed: %d:[%s].\n",
>>>+                      ret, sss_strerror(ret));
>>>+            }
>>>+        }
>>>+    }
>>which explains that this is a temporary solution until the IPA provider
>>can resolve external group membership. I have created
>>https://fedorahosted.org/sssd/ticket/2522 for this. Feel free to
>>explicitly add the ticket URL into the comment.
>>
>>bye,
>>Sumit
>Thanks for review.
>Please see updated patch.
>
//snip

> 
>+    /* This is a temporal solution until the IPA provider is able to
>+     * resolve external group membership.
>+     * https://fedorahosted.org/sssd/ticket/2522
>+     */
>+    if (opts->schema_type == SDAP_SCHEMA_IPA_V1) {
>+        ret = sysdb_attrs_get_string(attrs, SYSDB_SID_STR, &group_sid);
>+        if (ret != EOK) {
>+            DEBUG(SSSDBG_TRACE_FUNC, "Failed to get group sid\n");
>+            group_sid = NULL;
>+        }
>+
>+        if (group_sid != NULL) {
>+            ret = retain_extern_members(memctx, dom, group_name, group_sid,
>+                                        &userdns, &nuserdns);
>+            if (ret != EOK) {
>+                DEBUG(SSSDBG_MINOR_FAILURE,
>+                      "retain_extern_members failed: %d:[%s].\n",
                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
I was testing whether your patch fix some issues and this message looks
very dangerous in log files. It is ignored by default.
So it would be good to change debug level because it is not kind of error which
we are intrested in. (You can also change debug message or treat ENOENT
differently)


[sdap_save_grpmem] (0x0080): retain_extern_members failed: 2:[No such file or
                             directory].

LS



More information about the sssd-devel mailing list