[SSSD] [PATCH] MAN: Clarify that changing ID mapping options might require purging the cache

Jakub Hrozek jhrozek at redhat.com
Wed Feb 26 16:55:10 UTC 2014


On Wed, Feb 26, 2014 at 05:42:29PM +0100, Sumit Bose wrote:
> On Wed, Feb 26, 2014 at 04:15:30PM +0100, Jakub Hrozek wrote:
> > On Tue, Feb 25, 2014 at 08:53:45PM +0100, Jakub Hrozek wrote:
> > > On Tue, Feb 25, 2014 at 08:39:26PM +0100, Jakub Hrozek wrote:
> > > > On Tue, Feb 25, 2014 at 11:58:41AM -0500, Dmitri Pal wrote:
> > > > > On 02/25/2014 11:11 AM, Jakub Hrozek wrote:
> > > > > >Hi,
> > > > > >
> > > > > >the attached patch addresses #2252. I tried to make it clear that
> > > > > >removing the cache should only be done while online, but I'm open to any
> > > > > >further suggestions.
> > > > > >
> > > > > >
> > > > > >_______________________________________________
> > > > > >sssd-devel mailing list
> > > > > >sssd-devel at lists.fedorahosted.org
> > > > > >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> > > > > 
> > > > > +        Please note that changing the ID mapping related configuration
> > > > > +        options might cause --->the<---- user and group IDs to change. At the moment,
> > > > > +        SSSD does not support changing IDs, so the SSSD database must be
> > > > > +        removed. Because cached passwords are also stored in the database,
> > > > > +        removing the database should only be performed while the SSSD
> > > > > +        is online, otherwise users might get locked out.
> > > > > 
> > > > > I do not think you need "the" in this case.
> > > > 
> > > > Thank you, a new patch is attached. I'm constantly struggling with using
> > > > articles as Czech has no such concept :)
> > > 
> > > Sorry, I attached the original patch again by accident.
> > 
> > During an IRC discussion, Stephen suggested to use a bit stronger language
> > (will instead of might) and to stress out that changing IDs is not a
> > good idea as file ownership needs to be fixed as well.
> > 
> > A new patch is attached.
> 
> > From d27dcb79d19076580ee689d2cd42c0bb2f9fe905 Mon Sep 17 00:00:00 2001
> > From: Jakub Hrozek <jhrozek at redhat.com>
> > Date: Tue, 25 Feb 2014 17:09:00 +0100
> > Subject: [PATCH] MAN: Clarify that changing ID mapping options might require
> >  purging the cache
> > 
> > https://fedorahosted.org/sssd/ticket/2252
> > 
> > Currently SSSD chokes when IDs of users change, we don't support ID
> > changes yet. Because some users were confused about the failures, this
> > patch adds additional clarification.
> > ---
> >  src/man/include/ldap_id_mapping.xml | 11 +++++++++++
> >  1 file changed, 11 insertions(+)
> > 
> > diff --git a/src/man/include/ldap_id_mapping.xml b/src/man/include/ldap_id_mapping.xml
> > index 9dda399243bfd1725509c239d3358f2ef7501014..a10dcd52a1687c4d97211ebdabc77095bbfccf5a 100644
> > --- a/src/man/include/ldap_id_mapping.xml
> > +++ b/src/man/include/ldap_id_mapping.xml
> > @@ -12,6 +12,17 @@
> >          need to use manually-assigned values, ALL values must be
> >          manually-assigned.
> >      </para>
> > +    <para>
> > +        Please note that changing the ID mapping related configuration
> > +        options will cause user and group IDs to change. At the moment,
> > +        SSSD does not support changing IDs, so the SSSD database must be
> > +        removed. Because cached passwords are also stored in the database,
> > +        removing the database should only be performed while the SSSD
> > +        is online, otherwise users might get locked out. Moreover, the
> 
> 'while the SSSD is online', I think this is a bit missleading because I
> would read this as 'SSSD has to be running' and I think this is not what
> you meant. Maybe to steps should be given more explicit.

Right, I think this is because I'm too involved with the internals.

> 
> 1. make sure system is online and you servers are reachable
> 2. stop sssd
> 3. remove cache
> 4. start sssd

Added.

> 
> Additionally it might be good to mention that using sss_cache to
> invalidate teh cache is not sufficient.
> 
> bye,
> Sumit

Thanks for the review, a new patch is attached.
-------------- next part --------------
>From 014ac08946fcf2ba02f6e538e19bf233c44e53dd Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 25 Feb 2014 17:09:00 +0100
Subject: [PATCH] MAN: Clarify that changing ID mapping options might require
 purging the cache

https://fedorahosted.org/sssd/ticket/2252

Currently SSSD chokes when IDs of users change, we don't support ID
changes yet. Because some users were confused about the failures, this
patch adds additional clarification.
---
 src/man/include/ldap_id_mapping.xml | 39 +++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/src/man/include/ldap_id_mapping.xml b/src/man/include/ldap_id_mapping.xml
index 9dda399243bfd1725509c239d3358f2ef7501014..f06b52616801ca523326246cbb4d5e8b9c4de0fb 100644
--- a/src/man/include/ldap_id_mapping.xml
+++ b/src/man/include/ldap_id_mapping.xml
@@ -12,6 +12,45 @@
         need to use manually-assigned values, ALL values must be
         manually-assigned.
     </para>
+    <para>
+        Please note that changing the ID mapping related configuration
+        options will cause user and group IDs to change. At the moment,
+        SSSD does not support changing IDs, so the SSSD database must be
+        removed. Because cached passwords are also stored in the database,
+        removing the database should only be performed while the authentication
+        servers are reachable, otherwise users might get locked out. It is not
+        sufficient to use
+        <citerefentry>
+            <refentrytitle>sss_cache</refentrytitle>
+            <manvolnum>8</manvolnum>
+        </citerefentry>
+        to remove the database, rather the process
+        consists of:
+            <itemizedlist>
+                <listitem>
+                    <para>
+                        Making sure the remote servers are reachable
+                    </para>
+                    <para>
+                        Stopping the SSSD service
+                    </para>
+                </listitem>
+                <listitem>
+                    <para>
+                        Removing the database
+                    </para>
+                </listitem>
+                <listitem>
+                    <para>
+                        Starting the SSSD service
+                    </para>
+                </listitem>
+            </itemizedlist>
+        Moreover, as the change of IDs might necessitate the adjustment
+        of other system properties such as file and directory ownership,
+        it's advisable to plan ahead and test the ID mapping configuration
+        thoroughly.
+    </para>
 
     <refsect2 id='idmap_algorithm'>
         <title>Mapping Algorithm</title>
-- 
1.8.5.3



More information about the sssd-devel mailing list