[SSSD] [PATCHES] Wildcard lookups for InfoPipe
Jakub Hrozek
jhrozek at redhat.com
Thu Jun 18 11:03:49 UTC 2015
On Thu, Jun 18, 2015 at 10:09:06AM +0200, Jakub Hrozek wrote:
> Hi,
>
> the attached patches implement
> https://fedorahosted.org/sssd/ticket/2553.
>
> I'm sorry the patches took so long, but only during testing I realized the
> deleting of users not updated by the wildcard lookup is flawed. In case
> there were more entries in cache that match the wildcard than the limit
> on the wildcard search, we might be deleting legitimate entries that might
> contain cached credentials..
>
> What I did instead was never remove any entries during wildcard lookups,
> but instead, only return entries that were updated during the wildcard
> lookup in the cache_req. That way, stale entries would be deleted by a
> direct lookup (maybe as a result of getpwuid when examining a file) or
> can be deleted by the cleanup task.
>
> I'm a bit nervous about the LDAP changes, please review ruthlessly :-)
> I would also like for the option defaults to be carefully checked during
> review.
>
> One question about the by-name-and-domain lookups -- should we check the
> domain we receive from the cache_req is the same as we requested?
>
> btw I really like how the cache_req and the infopipe code are structured. It
> was quite easy to extend without any hacks.
CI: http://sssd-ci.duckdns.org/logs/job/17/60/summary.html
More information about the sssd-devel
mailing list