On 15.9.2015 10:23, Tomas Babej wrote:

from DS 1.3.3, the memberOf and referential integrity plugins have been
converted to backend transaction plugins, which means that failures in
these plugins will propagate and cause abort of the operation that
triggered them. [1]

I.e. in case of memberOf plugin, if a operation triggered an addition of
memberOf attribute, and that addition failed, the operation itself did
succeed in spite of this failure. This is no longer the case.

We have been already hit by this issue in winsync agreement setup:


However, there is little special about this case and there might be
multiple such entries in IPA which are added as group members,
but do not contain an objectclass which allows memberOf attribute.

So we need to step back and think - are there any other entries where
this change of behaviour will hit us?

As far as ipalib is concerned, these are the objects which may have the memberOf attribute (with object class providing it in parentheses):

    group (netstedGroup)
    hbacsvc (ipaHBACService)
    host (ipaHost)
    hostgroup (netstedGroup)
    netgroup (ipaNISNetgroup)
    privilege (nestedGroup)
    role (nestedGroup)
    service (ipaService)
    sudocmd (NONE)
    user (inetUser)

so memberOf needs to be added to ipaSudoCmd.

The config plugin lists memberOf as an operational attribute, which I guess is no longer the case?

Also, memberOf is excluded from replication in ipaserver/install/replication.py.

Jan Cholasta

Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to