[SSSD] [PATCHES] support local overrides

Pavel Březina pbrezina at redhat.com
Mon Jul 27 15:29:44 UTC 2015


On 07/27/2015 05:23 PM, Sumit Bose wrote:
> On Mon, Jul 27, 2015 at 05:09:17PM +0200, Jakub Hrozek wrote:
>> On Mon, Jul 27, 2015 at 12:00:25PM +0200, Pavel Březina wrote:
>>>> Hmm, why? Can we instead send a signal to SSSD to pick up the changes?
>>>> (If yes, then it can be a follow-up patch..)
>>>
>>> No, it is not possible to change view on the fly the way views are
>>> implemented.
>>>
>>
>> I think this is the rule for the IPA provider, but I don't see why it
>> should be this way in responders if we can update the domain info. I'll
>> file a ticket.
>
> I would say it is a general precaution. Switching the view on-the-fly
> might change UIDs and GIDs mappings of running processes and logged-in
> users on-the-fly. All kind of strange things might happen then, e.g.
> calling 'whoami' might return a different user name, if in the new view
> the UID of the running user belongs to a different user.

Hmm, that is not really a problem of viewname change, but of override 
added/modified/removed which is supported on the fly.

Are there any checks on IPA provider (or server) that prohibits 
overriding to a name/uid that already exist? The tool will allow.




More information about the sssd-devel mailing list