[SSSD] [PATCH] AD: use GC for SID requests as well
Jakub Hrozek
jhrozek at redhat.com
Wed Jan 28 14:27:44 UTC 2015
On Wed, Jan 28, 2015 at 03:05:00PM +0100, Sumit Bose wrote:
> Hi,
>
> another issue found by Steeve during testing. To reproduce this you need
> a universal group with members from different domains. Then either look
> up the group by SID e.g. with
>
> python -c "import pysss_nss_idmap; print pysss_nss_idmap.getnamebysid('S-1-5-21-3456664713-2053453454-4165325232-1234')"
>
> and then with getent group groupname.
>
> Or use IPA views, override the group name in the 'default trust view'
> on the IPA server and look up the group by the overridden name. In both
> case the group should not already be in the cache. Only members from the
> domain of the group should be show without the patch.
>
> bye,
> Sumit
The patch is correct, but I'm worried about the implications. What kind
of requests by SID does the server receive? Do we also resolve requests
for users by SID? In that case, we might be surprised that some POSIX
attributes are not available in GC..
More information about the sssd-devel
mailing list