[SSSD] On POSIX and non-POSIX groups

Jakub Hrozek jhrozek at redhat.com
Tue May 13 08:45:21 UTC 2014


Hi,

We had a question from one of our users about the proper behaviour of POSIX
and non-POSIX groups, where a POSIX group is one with a gidNumber and a
non-POSIX group is one that lacks the gidNumber.

I did a bit of testing and I think what I'm seeing is a bug, but some of
the code is quite old and the old commits lack proper commit messages and
links to upstream tickets, so I'd like to check with the other developers.

The question is -- should the complete hierarchy of mixed POSIX and
non-POSIX groups be saved to cache and resolved? I think it should.

As an example, consider this hierarchy:

    user ----- posix_group1
           \
            -- non_posix_group
                    \
                     --- posix_group2

I would expect that "id user" would return both "posix_group1" and
"posix_group2", but I only see "posix_group1".

Conversely, I think SSSD should also support expanding group hierarchy
for getgrnam/getgrgid requests, it seems that we even have code (git
show 00142aba00a2adcf32f0741b8ea8a31c5a461675) that should support this
case, but it wasn't working for me either.

The behaviour sounds like a bug to me.



More information about the sssd-devel mailing list