[SSSD] Fix #2275 nested netgroups do not work in IPA provider

Petr Cech pcech at redhat.com
Fri Sep 18 12:33:03 UTC 2015


On 09/14/2015 01:53 PM, Sumit Bose wrote:
> Hi Petr,
>
> thank you for your patience. Both versions of your patches work as
> expected and fixes the issues with group and nested group memberships.
>
> After testing a reading the current sources I think the best solution
> might be a slight variant of your first patch where you check for both
> memberOf and originalMemberOf but instead of always checking both I
> would suggest to pass down the attribute to check by adding a new member
> to struct extract_state and set it with the help of a new attribute to
> extract_members(). Since extract_members() is called individually for
> users and hosts in ipa_netgr_process_all() you can always pass the right
> attribute.Btw. instead of using SYSDB_ORIG_MEMBEROF and
> SYSDB_MEMBEROF explicitly you might want to use the configured mapping
> which e.g. is available in ipa_netgr_process_all() as
>
> state->ipa_opts->id->user_map[SDAP_AT_USER_MEMBEROF].sys_name
>
> bye,
> Sumit

Hello Sumit,

there is next version of patch addresing your comments.

I didn't use statement like
# state->ipa_opts->id->user_map[SDAP_AT_USER_MEMBEROF].sys_name
because we don't have any for originalMemberOf. I'm not sure if I added 
originalMemberOf version of statement above wheter it is not more like 
the second version of patch. If I understood the problem right, we 
wouldn't have saved both kind of memberOf in our DB.

Regards
Petr
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-IPA-PROVIDER-Resolve-nested-netgroup-membership.patch
Type: text/x-patch
Size: 3627 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150918/61d9771e/attachment.bin>


More information about the sssd-devel mailing list