[SSSD] [PATCH] IPA: resolve IPA group-memberships for AD users

Jakub Hrozek jhrozek at redhat.com
Mon Jan 26 22:46:58 UTC 2015


On Mon, Jan 26, 2015 at 08:53:56PM +0100, Jakub Hrozek wrote:
> On Fri, Jan 23, 2015 at 09:59:20PM +0100, Jakub Hrozek wrote:
> > On Fri, Jan 23, 2015 at 01:21:36PM +0100, Sumit Bose wrote:
> > > Hi,
> > > 
> > > this patch is a follow-up for the recent HBAC fixes. It turned out that
> > > the originalMemberOf attributes of AD users for IPA groups can be
> > > removed by some user lookups. To reproduce call
> > > 
> > > # sss_cache -E
> > > # id aduser at ad.domain
> > > # ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb  name=aduser at ad.domain memberof originalMemberOf
> > > 
> > > here originalMemberOf should be available for all AD and IPA groups.
> > > 
> > > # sss_cache -E
> > > # getent passwd aduser at ad.domain
> > > # ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb  name=aduser at ad.domain memberof originalMemberOf
> > > 
> > > now originalMemberOf only show AD groups.
> > > 
> > > bye,
> > > Sumit
> > 
> > CI passed:
> >     http://sssd-ci.duckdns.org/logs/commit/9a/aa8c05e11e7bcc0102b2f2d2efa3851999cf24/663/summary.html
> > 
> > I have some trouble testing the patch, I'll report back later.
> 
> It appears the SSSD instance on the client was wrong. I re-installed
> sssd on both server and client and now everything works fine.
> 
> ACK

* master: 63748c69a2c6785d949c82f94749704e0408e5a7
* sssd-1-12: e6aeb257e5b7d704530ce079c6e0ab9da1d5c139 



More information about the sssd-devel mailing list