[SSSD] [PATCH] MAN: Clarify that changing ID mapping options might require purging the cache

Sumit Bose sbose at redhat.com
Wed Feb 26 16:42:29 UTC 2014


On Wed, Feb 26, 2014 at 04:15:30PM +0100, Jakub Hrozek wrote:
> On Tue, Feb 25, 2014 at 08:53:45PM +0100, Jakub Hrozek wrote:
> > On Tue, Feb 25, 2014 at 08:39:26PM +0100, Jakub Hrozek wrote:
> > > On Tue, Feb 25, 2014 at 11:58:41AM -0500, Dmitri Pal wrote:
> > > > On 02/25/2014 11:11 AM, Jakub Hrozek wrote:
> > > > >Hi,
> > > > >
> > > > >the attached patch addresses #2252. I tried to make it clear that
> > > > >removing the cache should only be done while online, but I'm open to any
> > > > >further suggestions.
> > > > >
> > > > >
> > > > >_______________________________________________
> > > > >sssd-devel mailing list
> > > > >sssd-devel at lists.fedorahosted.org
> > > > >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> > > > 
> > > > +        Please note that changing the ID mapping related configuration
> > > > +        options might cause --->the<---- user and group IDs to change. At the moment,
> > > > +        SSSD does not support changing IDs, so the SSSD database must be
> > > > +        removed. Because cached passwords are also stored in the database,
> > > > +        removing the database should only be performed while the SSSD
> > > > +        is online, otherwise users might get locked out.
> > > > 
> > > > I do not think you need "the" in this case.
> > > 
> > > Thank you, a new patch is attached. I'm constantly struggling with using
> > > articles as Czech has no such concept :)
> > 
> > Sorry, I attached the original patch again by accident.
> 
> During an IRC discussion, Stephen suggested to use a bit stronger language
> (will instead of might) and to stress out that changing IDs is not a
> good idea as file ownership needs to be fixed as well.
> 
> A new patch is attached.

> From d27dcb79d19076580ee689d2cd42c0bb2f9fe905 Mon Sep 17 00:00:00 2001
> From: Jakub Hrozek <jhrozek at redhat.com>
> Date: Tue, 25 Feb 2014 17:09:00 +0100
> Subject: [PATCH] MAN: Clarify that changing ID mapping options might require
>  purging the cache
> 
> https://fedorahosted.org/sssd/ticket/2252
> 
> Currently SSSD chokes when IDs of users change, we don't support ID
> changes yet. Because some users were confused about the failures, this
> patch adds additional clarification.
> ---
>  src/man/include/ldap_id_mapping.xml | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/src/man/include/ldap_id_mapping.xml b/src/man/include/ldap_id_mapping.xml
> index 9dda399243bfd1725509c239d3358f2ef7501014..a10dcd52a1687c4d97211ebdabc77095bbfccf5a 100644
> --- a/src/man/include/ldap_id_mapping.xml
> +++ b/src/man/include/ldap_id_mapping.xml
> @@ -12,6 +12,17 @@
>          need to use manually-assigned values, ALL values must be
>          manually-assigned.
>      </para>
> +    <para>
> +        Please note that changing the ID mapping related configuration
> +        options will cause user and group IDs to change. At the moment,
> +        SSSD does not support changing IDs, so the SSSD database must be
> +        removed. Because cached passwords are also stored in the database,
> +        removing the database should only be performed while the SSSD
> +        is online, otherwise users might get locked out. Moreover, the

'while the SSSD is online', I think this is a bit missleading because I
would read this as 'SSSD has to be running' and I think this is not what
you meant. Maybe to steps should be given more explicit.

1. make sure system is online and you servers are reachable
2. stop sssd
3. remove cache
4. start sssd

Additionally it might be good to mention that using sss_cache to
invalidate teh cache is not sufficient.

bye,
Sumit
> +        change of IDs might neccessitate to adjust other system properties
> +        such as file and directory ownership, so it's advisable to plan
> +        ahead and test the ID mapping configuration thoroughly.
> +    </para>
>  
>      <refsect2 id='idmap_algorithm'>
>          <title>Mapping Algorithm</title>
> -- 
> 1.8.5.3
> 

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list