URL: https://github.com/SSSD/sssd/pull/879 Author: sumit-bose Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups Action: opened
PR body: """ Currently when an IPA client is resolving trusted users and groups with the help of the extdom plugin it uses the extdom plugin as well to lookup IPA objects. This might cause issues if e.g. there is a user in IPA with the same name as a group in AD or the other way round.
To solve this and to lower the load on the extdom plugin on the IPA server side this patch will lookup IPA object directly from LDAP on the IPA server.
Related to https://pagure.io/SSSD/sssd/issue/4073 """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/879/head:pr879 git checkout pr879
URL: https://github.com/SSSD/sssd/pull/879 Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups
pbrezina commented: """ How can I test it? Create user with the same name in IPA and AD and see that the one from IPA was returned? """
See the full comment at https://github.com/SSSD/sssd/pull/879#issuecomment-529411746
URL: https://github.com/SSSD/sssd/pull/879 Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups
sumit-bose commented: """ Hi,
I think the most easy reproducer with IPA is to add an AD user to one or more IPA groups. Then do 'id aduser@ad.domain' on an IPA client with an empty cache. When inspecting the domain logs you should see that all AD objects are looked up with the extdom plugin but the IPA groups are read with ldapsearch.
HTH
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/879#issuecomment-529437812
URL: https://github.com/SSSD/sssd/pull/879 Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups
pbrezina commented: """ Thank you. Ack. """
See the full comment at https://github.com/SSSD/sssd/pull/879#issuecomment-531727629
URL: https://github.com/SSSD/sssd/pull/879 Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/879 Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups
Label: +Ready to push
URL: https://github.com/SSSD/sssd/pull/879 Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups
pbrezina commented: """ * `master` * 27b141f38dd04d4b69e609a4cc64676a0716226e - ipa: use LDAP not extdom to lookup IPA users and groups
"""
See the full comment at https://github.com/SSSD/sssd/pull/879#issuecomment-532203325
URL: https://github.com/SSSD/sssd/pull/879 Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups
Label: +Pushed
URL: https://github.com/SSSD/sssd/pull/879 Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups
Label: -Accepted
URL: https://github.com/SSSD/sssd/pull/879 Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups
Label: -Ready to push
URL: https://github.com/SSSD/sssd/pull/879 Author: sumit-bose Title: #879: ipa: use LDAP not extdom to lookup IPA users and groups Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/879/head:pr879 git checkout pr879
sssd-devel@lists.fedorahosted.org
-
pbrezina -
sumit-bose