[SSSD] [PATCH] IPA: resolve IPA group-memberships for AD users
Jakub Hrozek
jhrozek at redhat.com
Fri Jan 23 20:59:20 UTC 2015
On Fri, Jan 23, 2015 at 01:21:36PM +0100, Sumit Bose wrote:
> Hi,
>
> this patch is a follow-up for the recent HBAC fixes. It turned out that
> the originalMemberOf attributes of AD users for IPA groups can be
> removed by some user lookups. To reproduce call
>
> # sss_cache -E
> # id aduser at ad.domain
> # ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb name=aduser at ad.domain memberof originalMemberOf
>
> here originalMemberOf should be available for all AD and IPA groups.
>
> # sss_cache -E
> # getent passwd aduser at ad.domain
> # ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb name=aduser at ad.domain memberof originalMemberOf
>
> now originalMemberOf only show AD groups.
>
> bye,
> Sumit
CI passed:
http://sssd-ci.duckdns.org/logs/commit/9a/aa8c05e11e7bcc0102b2f2d2efa3851999cf24/663/summary.html
I have some trouble testing the patch, I'll report back later.
More information about the sssd-devel
mailing list