[SSSD] [PATCH] IPA: use ipaUserGroup object class for groups

Alexander Bokovoy abokovoy at redhat.com
Fri Oct 31 13:55:53 UTC 2014


On Fri, 31 Oct 2014, Jakub Hrozek wrote:
>On Fri, Oct 31, 2014 at 02:36:54PM +0100, Pavel Březina wrote:
>> https://fedorahosted.org/sssd/ticket/2471
>>
>> AFAIK all group object in IPA has ipaUserGroup object class so it should be
>> general enough to cover all type of groups but excluding roles.
>
>Are you sure, even with non-POSIX groups, POSIX groups and user private
>groups (I haven't tested all three, I'm mostly asking..)
External groups use ipaUserGroup+ipaObject+nestedGroup (and few more)
object classes. However, UPGs don't use ipaUserGroup, they are using
posixGroup+ipaObject:

dn: cn=foobar2,cn=groups,cn=accounts,dc=ipacloud,dc=test
objectClass: posixgroup
objectClass: ipaobject
objectClass: mepManagedEntry
objectClass: top
cn: foobar2
gidNumber: 242800005
description: User private group for foobar2
mepManagedBy: uid=foobar2,cn=users,cn=accounts,dc=ipacloud,dc=test
ipaUniqueID: 1740bb50-6105-11e4-8e75-545200f9718b


-- 
/ Alexander Bokovoy



More information about the sssd-devel mailing list