[SSSD] [PATCH] IPA: use ipaUserGroup object class for groups

Jakub Hrozek jhrozek at redhat.com
Fri Oct 31 14:22:24 UTC 2014


On Fri, Oct 31, 2014 at 03:55:53PM +0200, Alexander Bokovoy wrote:
> On Fri, 31 Oct 2014, Jakub Hrozek wrote:
> >On Fri, Oct 31, 2014 at 02:36:54PM +0100, Pavel Březina wrote:
> >>https://fedorahosted.org/sssd/ticket/2471
> >>
> >>AFAIK all group object in IPA has ipaUserGroup object class so it should be
> >>general enough to cover all type of groups but excluding roles.
> >
> >Are you sure, even with non-POSIX groups, POSIX groups and user private
> >groups (I haven't tested all three, I'm mostly asking..)
> External groups use ipaUserGroup+ipaObject+nestedGroup (and few more)
> object classes. However, UPGs don't use ipaUserGroup, they are using
> posixGroup+ipaObject:

Right, currently SSSD supports looking entries by "objectClass" and
"alternative ObjectClass". The latter is currently only use for UPGs.

This is how the two OCs look after Pavel's patch:
    { "ldap_group_object_class", "ipaUserGroup", SYSDB_GROUP_CLASS, NULL },
    { "ldap_group_object_class_alt", "posixGroup", SYSDB_GROUP_CLASS, NULL },

The filter ORs the two entries.


> 
> dn: cn=foobar2,cn=groups,cn=accounts,dc=ipacloud,dc=test
> objectClass: posixgroup
> objectClass: ipaobject
> objectClass: mepManagedEntry
> objectClass: top
> cn: foobar2
> gidNumber: 242800005
> description: User private group for foobar2
> mepManagedBy: uid=foobar2,cn=users,cn=accounts,dc=ipacloud,dc=test
> ipaUniqueID: 1740bb50-6105-11e4-8e75-545200f9718b
> 
> 
> -- 
> / Alexander Bokovoy
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list