[SSSD] [PATCH] LDAP: retain external members

Jakub Hrozek jhrozek at redhat.com
Tue Jan 13 10:07:54 UTC 2015


On Mon, Jan 12, 2015 at 03:41:16PM +0100, Pavel Reichl wrote:
> 
> On 01/06/2015 09:12 AM, Jakub Hrozek wrote:
> >On Mon, Jan 05, 2015 at 07:18:13PM +0100, Pavel Reichl wrote:
> >>On 01/05/2015 04:55 PM, Jakub Hrozek wrote:
> >>>On Mon, Dec 15, 2014 at 04:36:46PM +0100, Sumit Bose wrote:
> >>>>On Sat, Dec 13, 2014 at 10:25:55PM +0100, Jakub Hrozek wrote:
> >>>>>On Sat, Dec 13, 2014 at 10:17:09PM +0100, Jakub Hrozek wrote:
> >>>>>>On Fri, Dec 12, 2014 at 05:19:00PM +0100, Sumit Bose wrote:
> >>>>>>>ACK
> >>>>>>>
> >>>>>>>bye,
> >>>>>>>Sumit
> >>>>>>master: 6fac5e5f0c54a0f92872ce1450606cfcb577a920
> >>>>>reviewers, if you think it makes sense to push this patch to sssd-1-11
> >>>>>as well, please holler.
> >>>>>
> >>>>>I personally don't -- this bug seems mostly be related to the server
> >>>>>mode and for IPA server side SSSD it just makes sense to go with
> >>>>>sssd-1-12.
> >>>>I think the patch is valid on 1.11 IPA clients as well because it makes
> >>>>sure that members of IPA groups which are  added from a different
> >>>>source, e.g. the PAC responder, are not removed if the group expires and
> >>>>is updated with data from the IPA LDAP group object, which does not
> >>>>contain the external users as members.
> >>>>
> >>>>So if there are issue on 1.11 where IPA group memberships of AD users
> >>>>get lost this patch might help here as well.
> >>>>
> >>>>bye,
> >>>>Sumit
> >>>OK.
> >>>
> >>>Pavel, can you then prepare the sssd-1-11 backport? The patch couldn't
> >>>be cherry-picked easily..
> >>>_______________________________________________
> >>>sssd-devel mailing list
> >>>sssd-devel at lists.fedorahosted.org
> >>>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >>Sure, patch for 1-11 is attached.
> >>Although necessary changes were minimal I would like if the patch was tested
> >>before it's pushed. Unfortunately my testing environment is completely
> >>broken right now.  So unless Sumit has his testing environment still handy
> >>and has time to test it I would prefer if we could wait for my testing then.
> >np, I'm not in a hurry. I would prefer if this patch was part of the
> >next 1.11 release, but we still have a known nested group segfault to
> >fix before we do that release..
> >_______________________________________________
> >sssd-devel mailing list
> >sssd-devel at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> I tested the patch - works fine. Thanks for patience.

* sssd-1-11: dcb16038ac779186aebbd7d37caab3736cb01466



More information about the sssd-devel mailing list