[SSSD] [PATCHES] Alternative objectClass for group maps

Sumit Bose sbose at redhat.com
Wed Sep 10 12:22:15 UTC 2014


On Wed, Sep 10, 2014 at 01:23:15PM +0200, Michal Židek wrote:
> Hi,
> 
> this patch should solve regression on IPA server
> triggered by the patches for this ticket:
> https://fedorahosted.org/sssd/ticket/2343
> 
> Patches for #2343 solved the IPA side of the
> problem by searching for objectclass groupOfNames
> instead of posixGroup (which was not available in
> non-posix groups). But (as we discovered now) not
> all groups in IPA are members of the objectClass
> groupOfNames (the private groups created
> automatically for users are not, so as a result
> we were not able to query them). So there is
> no common objectclass for all groups in IPA that
> would be suitable for group query filters.
> 
> So these 2 patches add the possibility to query
> groups using primary and alternative objectClass
> (ORed in the filter).
> 
> I tested the patches, but I would feel safer if
> someone pushed them to Beaker and run QE tests
> on it before pushing (I thing Jakub volunteered
> for this task off-list :) ).
> 
> Thank you,
> Michal

While I agree with the general approach I think the default for the
alternative objectclass should be NULL at it should only be added to the
search filter if defined. Maybe a function returning either
"(objectClass=group_oc)" or
"(|(objectClass=group_oc)(objectClass=alt_group_oc))" might help here.

I guess you did not include changes to the man page and the config API
on purpose to make it hard to change or unset the values. But
nevertheless it is a config option and should be handled as such.

I understand that we need a fix for the issue fast because it is in
already released. Hence I would agree if trac tickets are created for
the issues above for the next release.

bye,
Sumit



More information about the sssd-devel mailing list