[SSSD] Fix #2275 nested netgroups do not work in IPA provider

Sumit Bose sbose at redhat.com
Mon Sep 14 11:53:07 UTC 2015


On Fri, Sep 04, 2015 at 03:28:09PM +0200, Petr Cech wrote:
> On 09/04/2015 03:24 PM, Petr Cech wrote:
> >On 09/03/2015 03:45 PM, Sumit Bose wrote:
> >>>I tried both case. I used only originalMemberOf and I had right
> >>>hostgroups,
> >>>>no user groups. Then I used only memberOf and I had no hostgroups,
> >>>right
> >>>>user groups.
> >>>>
> >>>>So I did little hack, we could use both memberOf. The patch is
> >>>attached and
> >>>>it works for me.
> >>Hi Petr,
> >>
> >>thank you for the patch I haven't tested it yet. But I think I now
> >>understand the issue better. Currently we store the originalMemberOf
> >>attribute for users and hosts but not for POSIX/user groups (we do not
> >>even read it from LDAP). So an alternative fix might be to add memberOf
> >>attribute to the list of attribute read from LDAP for POSIX groups and
> >>save the result in originalMemberOf in the cache. The using only
> >>originalMemberOf should be sufficient for the netgroups lookup.
> >>
> >>Would you mind to try this? For a test is shoult de sufficient to add a
> >>line like
> >>
> >>     { "ldap_group_member_of", "memberOf", SYSDB_MEMBEROF, NULL }
> >>
> >>to all 'struct sdap_attr_map *_group_map[]' lists and a corresponding
> >>entry to 'enum sdap_group_attrs'.
> >>
> >>bye,
> >>Sumit
> >>
> >
> >Hello Sumit,
> >
> >I tried your alternative way (thanks for it). Patch is attached.
> >I added some lines like:
> >#  { "ldap_user_member_of", "memberOf", SYSDB_ORIG_MEMBEROF, NULL }
> >and it works for me.
> >
> >I hope that meaning of this patch is saving user/POSIX group memberOf
> >attribute to originalMemberOf attribute.
> >
> >Regards,
> >
> >Petr
> And there is version with ticket number.
> >
> >
> >_______________________________________________
> >sssd-devel mailing list
> >sssd-devel at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >

Hi Petr,

thank you for your patience. Both versions of your patches work as
expected and fixes the issues with group and nested group memberships.

After testing a reading the current sources I think the best solution
might be a slight variant of your first patch where you check for both
memberOf and originalMemberOf but instead of always checking both I
would suggest to pass down the attribute to check by adding a new member
to struct extract_state and set it with the help of a new attribute to
extract_members(). Since extract_members() is called individually for
users and hosts in ipa_netgr_process_all() you can always pass the right
attribute. Btw. instead of using SYSDB_ORIG_MEMBEROF and
SYSDB_MEMBEROF explicitly you might want to use the configured mapping
which e.g. is available in ipa_netgr_process_all() as

state->ipa_opts->id->user_map[SDAP_AT_USER_MEMBEROF].sys_name

bye,
Sumit 


More information about the sssd-devel mailing list