Pavel Zuna wrote:
Rob Crittenden wrote:
Pavel Zůna wrote:
Rob Crittenden wrote:
Pavel Zuna wrote:
Jason Gerard DeRose wrote:
On Fri, 2010-03-12 at 18:01 -0500, Rob Crittenden wrote:
Ensure that the group policy priority is unique.
We use CoS to determine the order in which group policy is
applied. The behavior in CoS is undefined for multiple entries
with the same
cospriority.
This likely relies on some other outstanding pwpolicy patches.
rob
ack. pushed to master.
The patch works, but I find the way it checks for priority
uniqueness highly ineffective. It pulls out all policies and then
retrieves their CoS entries one by one to do the checking. Instead
it should just make a search for a CoS entry with the given priority.
Pavel
Well, we may need to store the group policy entries in a subtree
then. All CoS policies are currently dumped into the same place
making this impossible.
Not necessarily. It's just a matter of tweaking the search filter. We
can search only for CoS entries, that have the krbContainer object
class and their krbPwdReference attribute contains a group DN.
Oh right, duh. Yeah, it is even simpler than that as we don't need to
look at group dns because only group policy is stored this way.
New patch attached.
rob
The patch looks fine, but doesn't apply since the original patch was
pushed.
Pavel
Ok, I just pushed out the diff in unique_priority then.
rob
_______________________________________________
Freeipa-devel mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/freeipa-devel
