[SSSD] [PATCH] views: do not require overrideDN in groups when LOCAL view is set

Pavel Březina pbrezina at redhat.com
Thu Sep 17 12:50:09 UTC 2015


On 09/17/2015 01:26 PM, Pavel Březina wrote:
> On 09/17/2015 01:21 PM, Sumit Bose wrote:
>> On Thu, Sep 17, 2015 at 12:44:37PM +0200, Pavel Březina wrote:
>>> On 09/17/2015 12:37 PM, Sumit Bose wrote:
>>>> On Thu, Sep 17, 2015 at 12:11:17PM +0200, Pavel Březina wrote:
>>>>> https://fedorahosted.org/sssd/ticket/2790
>>>>>
>>>>> This is just a partial fix.
>>>>>
>>>>> If a group contains member which doesn't have overrideDN specified,
>>>>> we fail
>>>>> to resolve membership with LOCAL views.
>>>>>
>>>>> There is a bigger issue when group contains ghost members, we do
>>>>> not apply
>>>>> overrides and just ignore the group. As code says, this is
>>>>> expected. Sumit,
>>>>> do you remember why it is this way?
>>>>
>>>> If there is an IPA idview applied to a client all objects have to be
>>>> completely resolved, i.e. the object must have been read from the
>>>> server
>>>> and it must have been checked if there is an override for the
>>>> object, to
>>>> return  the right result to the caller.
>>>>
>>>> Since ghost entries are not resolved completely ENOENT is return to
>>>> indicate to the caller to call the backend to resolve all needed
>>>> objects completely,
>>>>
>>>>>
>>>>> sysdb_getgrgid_with_views:
>>>>>>         if (el != NULL && el->num_values != 0) {
>>>>>>             DEBUG(SSSDBG_TRACE_ALL,
>>>>>>                   "Group object [%s], contains ghost entries which
>>>>>> must be " \
>>>>>>                   "resolved before overrides can be applied.\n",
>>>>>>                    ldb_dn_get_linearized(orig_obj->msgs[0]->dn));
>>>>>>             ret = ENOENT;
>>>>>>             goto done;
>>>>>>         }
>>>>>
>>>>> As I see it, we can do:
>>>>> 1) If group contains ghosts and memberuid, resolve memberuid
>>>>
>>>> I hope we can get rid of memberuid at some point. It was added as a
>>>> performance improvement at a time where we didn't had the memcache and
>>>> all request were handled by SSSD directly. Maybe this can be done
>>>> together with the planned sysdb changes which will store all entries
>>>> with a fully-qualified name.
>>>>
>>>>> 2) For each ghost user either:
>>>>>    a) Ignore
>>>>>    b) Put the name in
>>>>>    c) Try to find overrideObjectDN and apply possible name
>>>>> override, then put
>>>>> the name in
>>>>
>>>> I think b) should not be considered because it might return wrong
>>>> results. The other two options are valid.
>>>
>>> Is it possible to have unresolved user but its override values stored in
>>> sssd cache with IPA views?
>>
>> no, the override data is always written to the cache after the user
>> object.
>
> Then I think it will be best to keep it as is for IPA views, but resolve
> memberuid and put ghost in (1 and 2b) since it is not possible to have
> override object and unresolved user at the same time with local view. Do
> you agree?

As per meeting discussion I went ahead and wrote the patch.



-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-views-do-not-require-overrideDN-in-grous-when-LOCAL-.patch
Type: text/x-patch
Size: 1265 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150917/cb66bc65/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-views-fix-two-typos-in-debug-messages.patch
Type: text/x-patch
Size: 1280 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150917/cb66bc65/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-views-allow-ghost-members-for-LOCAL-view.patch
Type: text/x-patch
Size: 4155 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150917/cb66bc65/attachment-0002.bin>


More information about the sssd-devel mailing list