URL: https://github.com/SSSD/sssd/pull/202 Title: #202: T3315 infopipe group users master
fidencio commented: """ **Issue**: UpdateMemberList fails in case there's no ghost attribute in the group **Steps to reproduce**: - In an IPA server, create a user: ``` [root@master x86_64]# ipa user-add tuser99 --first="Test" --last="User" -------------------- Added user "tuser99" -------------------- User login: tuser99 First name: Test Last name: User Full name: Test User Display name: Test User Initials: TU Home directory: /home/tuser99 GECOS: Test User Login shell: /bin/bash Principal name: [email protected] Principal alias: [email protected] Email address: [email protected] UID: 1927800008 GID: 1927800008 Password: False Member of groups: ipausers Kerberos keys available: False ``` - Create a new group: ``` [root@master x86_64]# ipa group-add tgroup99 ---------------------- Added group "tgroup99" ---------------------- Group name: tgroup99 GID: 1927800009 ``` - Add the newly created user to the newly created group: ``` [root@master x86_64]# ipa group-add-member --users=tuser99 tgroup99 Group name: tgroup99 GID: 1927800009 Member users: tuser99 ------------------------- Number of members added 1 ``` - Checking the cache you'll notice that the newly created user and group are not there: ``` [root@master x86_64]# ldbsearch -H /var/lib/sss/db/cache_ipa.example.ldb asq: Unable to register control with rootdse! # record 1 dn: cn=views,cn=sysdb viewName: default distinguishedName: cn=views,cn=sysdb # record 2 dn: cn=ipa.example,cn=sysdb cn: ipa.example realmName: IPA.EXAMPLE distinguishedName: cn=ipa.example,cn=sysdb # record 3 dn: cn=ranges,cn=sysdb cn: ranges distinguishedName: cn=ranges,cn=sysdb # record 4 dn: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb cn: sudorules sudoLastFullRefreshTime: 1501501934 distinguishedName: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb # record 5 dn: cn=users,cn=ipa.example,cn=sysdb cn: Users distinguishedName: cn=users,cn=ipa.example,cn=sysdb # record 6 dn: cn=sysdb cn: sysdb description: base object version: 0.18 distinguishedName: cn=sysdb # record 7 dn: cn=groups,cn=ipa.example,cn=sysdb cn: Groups distinguishedName: cn=groups,cn=ipa.example,cn=sysdb # record 8 dn: cn=certmap,cn=sysdb cn: certmap userNameHint: FALSE distinguishedName: cn=certmap,cn=sysdb # returned 8 records # 8 entries # 0 referrals ``` - Call the FindByName method for the group: ``` [root@master x86_64]# dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Groups org.freedesktop.sssd.infopipe.Groups.FindByName string:tgroup99 method return time=1501502395.330843 sender=:1.544 -> destination=:1.546 serial=5 reply_serial=2 object path "/org/freedesktop/sssd/infopipe/Groups/ipa_2eexample/1927800009" ``` - Checking the cache you'll notice that the group is there and the user is shown there in the ghost attribute: ``` [root@master x86_64]# ldbsearch -H /var/lib/sss/db/cache_ipa.example.ldb asq: Unable to register control with rootdse! # record 1 dn: [email protected],cn=groups,cn=ipa.example,cn=sysdb createTimestamp: 1501502395 gidNumber: 1927800009 name: [email protected] objectClass: group uniqueID: d51d90a0-75e6-11e7-b172-52540072ab99 isPosix: TRUE originalDN: cn=tgroup99,cn=groups,cn=accounts,dc=ipa,dc=example originalModifyTimestamp: 20170731115328Z entryUSN: 5288 orig_member: uid=tuser99,cn=users,cn=accounts,dc=ipa,dc=example ghost: [email protected] nameAlias: [email protected] lastUpdate: 1501502395 dataExpireTimestamp: 1501507795 overrideDN: [email protected],cn=groups,cn=ipa.example,cn=sysdb distinguishedName: [email protected],cn=groups,cn=ipa.example,cn=sysdb # record 2 dn: cn=views,cn=sysdb viewName: default distinguishedName: cn=views,cn=sysdb # record 3 dn: cn=ipa.example,cn=sysdb cn: ipa.example realmName: IPA.EXAMPLE distinguishedName: cn=ipa.example,cn=sysdb # record 4 dn: cn=ranges,cn=sysdb cn: ranges distinguishedName: cn=ranges,cn=sysdb # record 5 dn: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb cn: sudorules sudoLastFullRefreshTime: 1501501934 distinguishedName: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb # record 6 dn: cn=users,cn=ipa.example,cn=sysdb cn: Users distinguishedName: cn=users,cn=ipa.example,cn=sysdb # record 7 dn: cn=sysdb cn: sysdb description: base object version: 0.18 distinguishedName: cn=sysdb # record 8 dn: cn=groups,cn=ipa.example,cn=sysdb cn: Groups distinguishedName: cn=groups,cn=ipa.example,cn=sysdb # record 9 dn: cn=certmap,cn=sysdb cn: certmap userNameHint: FALSE distinguishedName: cn=certmap,cn=sysdb # returned 9 records # 9 entries # 0 referrals ``` - Call the UpdateMemberList method: ``` [root@master x86_64]# dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Groups/ipa_2eexample/1927800009 org.freedesktop.sssd.infopipe.Groups.Group.UpdateMemberList method return time=1501502656.424735 sender=:1.544 -> destination=:1.547 serial=7 reply_serial=2 ``` - Checking the cache you'll notice that the group has no more the ghost attribute and that the user entry was added to the cache: ``` [root@master x86_64]# ldbsearch -H /var/lib/sss/db/cache_ipa.example.ldb asq: Unable to register control with rootdse! # record 1 dn: [email protected],cn=groups,cn=ipa.example,cn=sysdb createTimestamp: 1501502395 gidNumber: 1927800009 name: [email protected] objectClass: group uniqueID: d51d90a0-75e6-11e7-b172-52540072ab99 isPosix: TRUE originalDN: cn=tgroup99,cn=groups,cn=accounts,dc=ipa,dc=example originalModifyTimestamp: 20170731115328Z entryUSN: 5288 orig_member: uid=tuser99,cn=users,cn=accounts,dc=ipa,dc=example nameAlias: [email protected] lastUpdate: 1501502395 dataExpireTimestamp: 1501507795 overrideDN: [email protected],cn=groups,cn=ipa.example,cn=sysdb member: [email protected],cn=users,cn=ipa.example,cn=sysdb memberuid: [email protected] distinguishedName: [email protected],cn=groups,cn=ipa.example,cn=sysdb # record 2 dn: cn=views,cn=sysdb viewName: default distinguishedName: cn=views,cn=sysdb # record 3 dn: [email protected],cn=users,cn=ipa.example,cn=sysdb createTimestamp: 1501502656 fullName: Test User gecos: Test User gidNumber: 1927800008 homeDirectory: /home/tuser99 loginShell: /bin/bash name: [email protected] objectClass: user uidNumber: 1927800008 uniqueID: c874c08a-75e6-11e7-afeb-52540072ab99 originalDN: uid=tuser99,cn=users,cn=accounts,dc=ipa,dc=example originalMemberOf: cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=example originalMemberOf: cn=tgroup99,cn=groups,cn=accounts,dc=ipa,dc=example originalModifyTimestamp: 20170731115328Z entryUSN: 5289 userPrincipalName: [email protected] mail: [email protected] nameAlias: [email protected] isPosix: TRUE lastUpdate: 1501502656 dataExpireTimestamp: 1501508056 memberof: [email protected],cn=groups,cn=ipa.example,cn=sysdb overrideDN: [email protected],cn=users,cn=ipa.example,cn=sysdb distinguishedName: [email protected],cn=users,cn=ipa.example,cn=sysdb # record 4 dn: cn=ipa.example,cn=sysdb cn: ipa.example realmName: IPA.EXAMPLE distinguishedName: cn=ipa.example,cn=sysdb # record 5 dn: cn=ranges,cn=sysdb cn: ranges distinguishedName: cn=ranges,cn=sysdb # record 6 dn: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb cn: sudorules sudoLastFullRefreshTime: 1501501934 distinguishedName: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb # record 7 dn: cn=users,cn=ipa.example,cn=sysdb cn: Users distinguishedName: cn=users,cn=ipa.example,cn=sysdb # record 8 dn: cn=sysdb cn: sysdb description: base object version: 0.18 distinguishedName: cn=sysdb # record 9 dn: cn=groups,cn=ipa.example,cn=sysdb cn: Groups distinguishedName: cn=groups,cn=ipa.example,cn=sysdb # record 10 dn: cn=certmap,cn=sysdb cn: certmap userNameHint: FALSE distinguishedName: cn=certmap,cn=sysdb # returned 10 records # 10 entries # 0 referrals ``` - Now, this is the point where you can see a bug in the UpdateMemberList method and it'll happen by calling the method again, for the very same group (as, right now, this group has no ghost attribute there): ``` [root@master x86_64]# dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Groups/ipa_2eexample/1927800009 org.freedesktop.sssd.infopipe.Groups.Group.UpdateMemberList Error org.freedesktop.DBus.Error.Failed: Unable to resolve ghost members [12]: Cannot allocate memory ``` The error basically happens because, in `resolv_ghosts_group_done()`, a SYSDB_GHOST element is always expected, while it would be perfectly fine that the element is not there. That's what @celestian's patch is about and I've changed a little but the commit message in order to make it cleaner. @mzidek-rh: Please, let me know whether the description is clear enough and whether you're able to reproduce the issue following the step-by-step I've provided. """ See the full comment at https://github.com/SSSD/sssd/pull/202#issuecomment-319049987
_______________________________________________ sssd-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
