[SSSD] [PATCH] IPA: process_members() add ghosts only once

Sumit Bose sbose at redhat.com
Fri Jan 23 16:01:45 UTC 2015


Hi,

this patch fixes an issue caused by
https://fedorahosted.org/sssd/ticket/2567 on the IPA client side. If on
the IPA server side a group member is returned twice for a universal
group the extdom plugin will deliver this duplicated entry to the IPA
client. On the client side saving this list to the cache will fail with a
LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS error. With this patch the duplicated
entries are filtered out.

bye,
Sumit
-------------- next part --------------
From c608d212a6d59f06e53baacc9bce8549b62557cc Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 21 Jan 2015 16:33:59 +0100
Subject: [PATCH] IPA: process_members() add ghosts only once

Since ghost entries might not be properly removed on the IPA server
(https://fedorahosted.org/sssd/ticket/2567) chances are that during
extdom group lookups a single user is returned multiple time. This patch
removes the duplicates before trying to write the data to the cache.

Related to https://fedorahosted.org/sssd/ticket/2159
---
 src/providers/ipa/ipa_s2n_exop.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
index 997d0dce8d3225f83bbce506d349e4a8705e1e95..6f8d5687d66717ba62e83da27dd6b23bc12151fb 100644
--- a/src/providers/ipa/ipa_s2n_exop.c
+++ b/src/providers/ipa/ipa_s2n_exop.c
@@ -1299,8 +1299,10 @@ static errno_t process_members(struct sss_domain_info *domain,
                 DEBUG(SSSDBG_TRACE_ALL, "Adding ghost member [%s]\n",
                                         members[c]);
 
-                ret = sysdb_attrs_add_string(group_attrs, SYSDB_GHOST,
-                                             members[c]);
+                /* There were cases where the server returned the same user
+                 * multiple times */
+                ret = sysdb_attrs_add_string_safe(group_attrs, SYSDB_GHOST,
+                                                  members[c]);
                 if (ret != EOK) {
                     DEBUG(SSSDBG_OP_FAILURE,
                           "sysdb_attrs_add_string failed.\n");
-- 
2.1.0



More information about the sssd-devel mailing list