[SSSD] Fix #2275 nested netgroups do not work in IPA provider

Sumit Bose sbose at redhat.com
Thu Sep 3 13:45:59 UTC 2015


On Thu, Sep 03, 2015 at 01:50:35PM +0200, Petr Cech wrote:
> On 09/03/2015 10:08 AM, Sumit Bose wrote:
> >On Thu, Sep 03, 2015 at 09:54:51AM +0200, Jakub Hrozek wrote:
> >>On Thu, Sep 03, 2015 at 09:31:07AM +0200, Petr Cech wrote:
> >>>On 09/03/2015 08:18 AM, Jakub Hrozek wrote:
> >>>>On Thu, Sep 03, 2015 at 06:15:24AM +0200, Lukas Slebodnik wrote:
> >>>>>On (02/09/15 18:06), Petr Cech wrote:
> >>>>>>Hi,
> >>>>>>
> >>>>>>reverting this commit "5e9bc89b28f1ac3ce573ecdece74fe9623580c28" fixed the
> >>>>>>problem for me. So is the original commit no longer valid?
> >>>>>>
> >>>>>I'm little bit worried about reverting this patch.
> >>>>>Did you test the bug which was fixed by this commit.
> >>>>>@see https://fedorahosted.org/sssd/ticket/1519
> >>>Thanks.
> >>>
> >>>Tested. We need both patches (because user groups are in memberOf and host
> >>>groups are in orig_memberOf).
> >>>Simple, I will do it.
> >>>
> >>>Is it OK that freeIPA use two kind of memberOf?
> >>
> >>It does not. In FreeIPA LDAP there should only be memberOf (check it
> >>out with openldap). What is happening is that we internally store IPA's
> >>memberof value as originalMemberOf and our memberof points to cached
> >>objects.
> >
> >yes and since we (so far) only store POSIX groups (user groups) in the
> >SSSD cache memberOf will only point to user groups. But as Jakub said
> >originalMemberOf should contain all memberOf attributres from the
> >related IPA LDAP object. Hence I would expect that originalMemberOf will
> >have a complete list of memberships with both user and host groups.
> >
> >bye,
> >Sumit
> I tried both case. I used only originalMemberOf and I had right hostgroups,
> no user groups. Then I used only memberOf and I had no hostgroups, right
> user groups.
> 
> So I did little hack, we could use both memberOf. The patch is attached and
> it works for me.

Hi Petr,

thank you for the patch I haven't tested it yet. But I think I now
understand the issue better. Currently we store the originalMemberOf
attribute for users and hosts but not for POSIX/user groups (we do not
even read it from LDAP). So an alternative fix might be to add memberOf
attribute to the list of attribute read from LDAP for POSIX groups and
save the result in originalMemberOf in the cache. The using only
originalMemberOf should be sufficient for the netgroups lookup.

Would you mind to try this? For a test is shoult de sufficient to add a
line like

    { "ldap_group_member_of", "memberOf", SYSDB_MEMBEROF, NULL }

to all 'struct sdap_attr_map *_group_map[]' lists and a corresponding
entry to 'enum sdap_group_attrs'.

bye,
Sumit

> 
> Petr
> >
> >>_______________________________________________
> >>sssd-devel mailing list
> >>sssd-devel at lists.fedorahosted.org
> >>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >_______________________________________________
> >sssd-devel mailing list
> >sssd-devel at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >


More information about the sssd-devel mailing list