[SSSD] [PATCH] LDAP: retain external members

Jakub Hrozek jhrozek at redhat.com
Tue Jan 6 08:12:55 UTC 2015


On Mon, Jan 05, 2015 at 07:18:13PM +0100, Pavel Reichl wrote:
> 
> On 01/05/2015 04:55 PM, Jakub Hrozek wrote:
> >On Mon, Dec 15, 2014 at 04:36:46PM +0100, Sumit Bose wrote:
> >>On Sat, Dec 13, 2014 at 10:25:55PM +0100, Jakub Hrozek wrote:
> >>>On Sat, Dec 13, 2014 at 10:17:09PM +0100, Jakub Hrozek wrote:
> >>>>On Fri, Dec 12, 2014 at 05:19:00PM +0100, Sumit Bose wrote:
> >>>>>ACK
> >>>>>
> >>>>>bye,
> >>>>>Sumit
> >>>>master: 6fac5e5f0c54a0f92872ce1450606cfcb577a920
> >>>reviewers, if you think it makes sense to push this patch to sssd-1-11
> >>>as well, please holler.
> >>>
> >>>I personally don't -- this bug seems mostly be related to the server
> >>>mode and for IPA server side SSSD it just makes sense to go with
> >>>sssd-1-12.
> >>I think the patch is valid on 1.11 IPA clients as well because it makes
> >>sure that members of IPA groups which are  added from a different
> >>source, e.g. the PAC responder, are not removed if the group expires and
> >>is updated with data from the IPA LDAP group object, which does not
> >>contain the external users as members.
> >>
> >>So if there are issue on 1.11 where IPA group memberships of AD users
> >>get lost this patch might help here as well.
> >>
> >>bye,
> >>Sumit
> >OK.
> >
> >Pavel, can you then prepare the sssd-1-11 backport? The patch couldn't
> >be cherry-picked easily..
> >_______________________________________________
> >sssd-devel mailing list
> >sssd-devel at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> Sure, patch for 1-11 is attached.
> Although necessary changes were minimal I would like if the patch was tested
> before it's pushed. Unfortunately my testing environment is completely
> broken right now.  So unless Sumit has his testing environment still handy
> and has time to test it I would prefer if we could wait for my testing then.

np, I'm not in a hurry. I would prefer if this patch was part of the
next 1.11 release, but we still have a known nested group segfault to
fix before we do that release..



More information about the sssd-devel mailing list