[SSSD] [PATCH] IPA: Use GC for group lookups in server mode

Pavel Reichl preichl at redhat.com
Tue Sep 23 14:40:25 UTC 2014


On 09/09/2014 10:41 PM, Jakub Hrozek wrote:
> Hi,
>
> the attached patch enables cross-domain group lookups.
>
> Even though AD trusts often work with POSIX attributes which are
> normally not replicated to GC, our group lookups are smart since commit
> 008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using
> the LDAP connection and only use the GC connection to look up the members.
>
> I tested the patch with trusts that use ID-mapping, there the
> cross-domain memberships are resolved fine.
>
> For setups that use POSIX mapping, only the members from the domain that
> the group belongs to is visible -- that is because the AD back end
> currently tests if POSIX attributes are in use and if they are, GC
> support is completely disabled. Perhaps this is something to work on in
> 1.13 when we refactor the group membership, but for now I'd like to keep
> the patch (and associated risk) minimal.
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
ACK
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140923/f9549a55/attachment.html>


More information about the sssd-devel mailing list