ipa s2n: do not try to update user-private-group#8002
ipa s2n: do not try to update user-private-group#8002alexey-tikhonov merged 2 commits intoSSSD:masterfrom
Conversation
|
Is this related to https://issues.redhat.com/browse/RHEL-94545 ? |
f5d64b3 to
b854636
Compare
88f9155 to
2c72fc0
Compare
|
@sumit-bose, is there a related ticket? |
Yes, this issue is present in |
|
Failing tests seem to be failing on every PR. |
2c72fc0 to
5c947a3
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request addresses an issue where SSSD would fail to resolve a trusted user after a view change if the user has a user-private-group. The root cause is that SSSD was incorrectly trying to update the user-private-group as a regular group object, which is not supported. The fix is to check the object's category and only attempt to update real group objects, skipping user-private-groups. The change is implemented correctly in ipa_s2n_exop.c by fetching and checking the SYSDB_OBJECTCATEGORY attribute before adding a group to the list of objects to be updated. A new system test is also added in test_ipa_trusts.py which accurately reproduces the scenario and validates the fix. The changes look good and address the issue effectively.
|
Note: Covscan is green. |
When an IPA client requests the details about a trusted user from the IPA server including its memberships the server will return the name of all groups including the user-private-group. Since this group is not a cached object on its own it is not needed to try to update it as a group but it will be updated when the user object is updated. This has to be taken into account especially after a client is assigned to a new id-view because now the SYSDB_OVERRIDE_DN attribute is required and all cached objects which are missing it must be updated. If the user-private-group was found for update it should be skipped because the calls to update group objects in the cache cannot handle user-private-groups. This is expected behavior as user-private-groups are not objects on their own. Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Alejandro López <allopez@redhat.com>
After a new view is applied to a client SSSD should make sure that the cache entries are updated properly and all cached users can still be resolved properly. Reviewed-by: Alexey Tikhonov <atikhono@redhat.com> Reviewed-by: Alejandro López <allopez@redhat.com>
5c947a3 to
6878634
Compare
When an IPA client requests the details about a trusted user from the
IPA server including its memberships the server will return the name of
all groups including the user-private-group. Since this group is not a
cached object on its own it is not needed to try to update it as a group
but it will be updated when the user object is updated.
This has to be taken into account especially after a client is assigned
to a new id-view because now the SYSDB_OVERRIDE_DN attribute is required
and all cached objects which are missing it must be updated. If the
user-private-group was found for update it should be skipped because the
calls to update group objects in the cache cannot handle
user-private-groups. This is expected behavior as user-private-groups
are not objects on their own.