[SSSD] [PATCH] views: do not require overrideDN in groups when LOCAL view is set

Sumit Bose sbose at redhat.com
Thu Sep 17 10:37:48 UTC 2015


On Thu, Sep 17, 2015 at 12:11:17PM +0200, Pavel Březina wrote:
> https://fedorahosted.org/sssd/ticket/2790
> 
> This is just a partial fix.
> 
> If a group contains member which doesn't have overrideDN specified, we fail
> to resolve membership with LOCAL views.
> 
> There is a bigger issue when group contains ghost members, we do not apply
> overrides and just ignore the group. As code says, this is expected. Sumit,
> do you remember why it is this way?

If there is an IPA idview applied to a client all objects have to be
completely resolved, i.e. the object must have been read from the server
and it must have been checked if there is an override for the object, to
return  the right result to the caller.

Since ghost entries are not resolved completely ENOENT is return to
indicate to the caller to call the backend to resolve all needed
objects completely,

> 
> sysdb_getgrgid_with_views:
> >        if (el != NULL && el->num_values != 0) {
> >            DEBUG(SSSDBG_TRACE_ALL,
> >                  "Group object [%s], contains ghost entries which must be " \
> >                  "resolved before overrides can be applied.\n",
> >                   ldb_dn_get_linearized(orig_obj->msgs[0]->dn));
> >            ret = ENOENT;
> >            goto done;
> >        }
> 
> As I see it, we can do:
> 1) If group contains ghosts and memberuid, resolve memberuid

I hope we can get rid of memberuid at some point. It was added as a
performance improvement at a time where we didn't had the memcache and
all request were handled by SSSD directly. Maybe this can be done
together with the planned sysdb changes which will store all entries
with a fully-qualified name.

> 2) For each ghost user either:
>   a) Ignore
>   b) Put the name in
>   c) Try to find overrideObjectDN and apply possible name override, then put
> the name in

I think b) should not be considered because it might return wrong
results. The other two options are valid.

HTH

bye,
Sumit



More information about the sssd-devel mailing list