[SSSD] [PATCHES] IPA: fixed for initgroups with overrides

Jakub Hrozek jhrozek at redhat.com
Wed Apr 29 12:12:48 UTC 2015


On Wed, Apr 29, 2015 at 11:25:04AM +0200, Sumit Bose wrote:
> Hi,
> 
> while analyzing the test case described in
> https://fedorahosted.org/sssd/ticket/2633 I found some issues both in
> the client and server code which are hopefully fixed by the attached
> patch set.
> 
> bye,
> Sumit

> From 23bec0c3fdf035dfc441dc4f668aad7df4a77ebd Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Tue, 28 Apr 2015 17:18:48 +0200
> Subject: [PATCH 1/4] IPA: do initgroups if extdom exop supports it
> 
> Newer versions of the extdom plugin return the full list of
> group-memberships during a user lookup request. With these version there
> is no need to reject a initgroups request for sub/trusted-domain users
> anymore. This is e.g. useful for callers which call getgrouplist()
> directly without calling getpwnam() before. Additionally it helps if for
> some reasons the lifetime of the user entry and the lifetime of the
> initgroups data is different.
> 
> Related to https://fedorahosted.org/sssd/ticket/2633

ACK

Makes sense, tested with id from command line and os.initgroups() from
Python.

> From 627ebf1782fb5dafa2536f5d451e1d39f46f0012 Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Tue, 28 Apr 2015 17:20:05 +0200
> Subject: [PATCH 2/4] IPA: update initgr expire timestamp conditionally
> 
> Newer versions of the extdom plugin return the full list of
> group-memberships during user lookups. As a result the lifetime of the
> group-membership data is updates in those cases. But if the user is not
> looked up directly but is resolved as a group member during a group
> lookup SSSD does not resolve all group-membership of the user to avoid
> deep recursion and eventually a complete enumeration of the user and
> group base. In this case the lifetime of the group-memberships should
> not be updated because it might be incomplete.
> 
> Related to https://fedorahosted.org/sssd/ticket/2633

ACK, nice catch

> From 0dcbb088866cbc459379f8c0e23a75585b2036a8 Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Tue, 28 Apr 2015 20:58:15 +0200
> Subject: [PATCH 3/4] IPA: enhance ipa_initgr_get_overrides_send()
> 
> This patch makes ipa_initgr_get_overrides_send() public and add support
> to search overrides by UUID or by SID.

Do you think this interface might be used more in the future? If yes,
then it would be cleaner to also restrict the synopsis of the function
with some enum or wrap around mini-request that would pass the ar
directly rather than allowing generic char* and then checking against
known values.

But for now I'm fine with letting the code go, if the programmer uses
the interface, he would get an error with an unsupported value..

> From 94f9ab29cd40338e7fa7dee636065cf8d06ec330 Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Tue, 28 Apr 2015 20:59:43 +0200
> Subject: [PATCH 4/4] IPA: search for overrides during initgroups in sever mode
> 
> After the group memberships of a user from a trusted domain are read it
> must be checked if there are overrides for the discovered groups to be
> able to return the right gid or name to the caller.
> 
> Related to https://fedorahosted.org/sssd/ticket/2633

This patch causes a compilation warning:
src/providers/ipa/ipa_subdomains_id.c: In function 'ipa_id_get_groups_overrides_done':
src/providers/ipa/ipa_subdomains_id.c:1225:35: warning: unused variable 'state' [-Wunused-variable]
     struct ipa_get_ad_acct_state *state = tevent_req_data(req,

But functionally-wise seems OK.



More information about the sssd-devel mailing list