diff options
Diffstat (limited to 'zarb-ml/mageia-sysadm/2011-April/003396.html')
| -rw-r--r-- | zarb-ml/mageia-sysadm/2011-April/003396.html | 136 |
1 files changed, 136 insertions, 0 deletions
diff --git a/zarb-ml/mageia-sysadm/2011-April/003396.html b/zarb-ml/mageia-sysadm/2011-April/003396.html new file mode 100644 index 000000000..0ac001297 --- /dev/null +++ b/zarb-ml/mageia-sysadm/2011-April/003396.html @@ -0,0 +1,136 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> +<HTML> + <HEAD> + <TITLE> [Mageia-sysadm] Dynlist and change on ldap + </TITLE> + <LINK REL="Index" HREF="index.html" > + <LINK REL="made" HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20Dynlist%20and%20change%20on%20ldap&In-Reply-To=%3C20110425174426.GA29647%40sisay.ephaone.org%3E"> + <META NAME="robots" CONTENT="index,nofollow"> + <META http-equiv="Content-Type" content="text/html; charset=us-ascii"> + <LINK REL="Previous" HREF="003393.html"> + <LINK REL="Next" HREF="003398.html"> + </HEAD> + <BODY BGCOLOR="#ffffff"> + <H1>[Mageia-sysadm] Dynlist and change on ldap</H1> + <B>Michael scherer</B> + <A HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20Dynlist%20and%20change%20on%20ldap&In-Reply-To=%3C20110425174426.GA29647%40sisay.ephaone.org%3E" + TITLE="[Mageia-sysadm] Dynlist and change on ldap">misc at zarb.org + </A><BR> + <I>Mon Apr 25 19:44:26 CEST 2011</I> + <P><UL> + <LI>Previous message: <A HREF="003393.html">[Mageia-sysadm] Dynlist and change on ldap +</A></li> + <LI>Next message: <A HREF="003398.html">[Mageia-sysadm] Beta 2 on mirror +</A></li> + <LI> <B>Messages sorted by:</B> + <a href="date.html#3396">[ date ]</a> + <a href="thread.html#3396">[ thread ]</a> + <a href="subject.html#3396">[ subject ]</a> + <a href="author.html#3396">[ author ]</a> + </LI> + </UL> + <HR> +<!--beginarticle--> +<PRE>On Mon, Apr 25, 2011 at 02:58:05PM +0200, Michael scherer wrote: +><i> On Mon, Apr 25, 2011 at 12:12:59PM +0200, Michael scherer wrote: +</I>><i> > On Thu, Apr 21, 2011 at 10:09:34PM +0200, Michael Scherer wrote: +</I>><i> > > Le jeudi 21 avril 2011 à 22:04 +0200, Michael Scherer a écrit : +</I>><i> > > +</I>><i> > > > To use it, just add a group like this : +</I>><i> > > > +</I>><i> > > > cn=mga-test_dyn,ou=Group,dc=mageia,dc=org +</I>><i> > > > cn: mga-test_dyn +</I>><i> > > > objectClass: posixGroup +</I>><i> > > > objectClass: groupOfURLs +</I>><i> > > > gidNumber: 5013 +</I>><i> > > > memberURL: +</I>><i> > > > <A HREF="ldap:///ou=People,dc=mageia,dc=org?dn?sub?(&(objectClass=posixAccount">ldap:///ou=People,dc=mageia,dc=org?dn?sub?(&(objectClass=posixAccount</A>)(memberOf=cn=mga-council,ou=Group,dc=mageia,dc=org)) +</I>><i> > > > memberURL: +</I>><i> > > > <A HREF="ldap:///ou=People,dc=mageia,dc=org?dn?sub?(&(objectClass=posixAccount">ldap:///ou=People,dc=mageia,dc=org?dn?sub?(&(objectClass=posixAccount</A>)(memberOf=cn=mga-sysadmin,ou=Group,dc=mageia,dc=org)) +</I>><i> > > > +</I>><i> > > > This one will create a group with sysadmin and council member. +</I>><i> > > > +</I>><i> > > > # getent group mga-test_dyn +</I>><i> > > > mga-test_dyn:*:5013:misc,rda,boklm,tmb,ennael,dams,buchan,dmorgan,nanardon,colin,blino,pterjan +</I>><i> > > > +</I>><i> > > > ( ok here, it doesn't work fully, wobo and trishf42 are missing but +</I>><i> > > > since ennael and rda are not in sysadmin group, this kinda work, I will +</I>><i> > > > look at this more closely, maybe a index issue, or memberOf not being +</I>><i> > > > refreshed ) +</I>><i> > > +</I>><i> > > Ok as usual, I first say something stupid and then find the issue. +</I>><i> > > +</I>><i> > > Of course, for this example, we should not add +</I>><i> > > "(objectClass=posixAccount)" in the filter, as neither wobo or trishf42 +</I>><i> > > have a posixAccount :) +</I>><i> > +</I>><i> > So I finally made the changes to ldap : +</I>><i> > created a group called mga-shell_access +</I>><i> > changed svn acl for that +</I>><i> > +</I>><i> > the only issue that I faced was that some members ( ie all i18n and me ) were +</I>><i> > not able to use the svn, as "id $login" didn't show that they were in the +</I>><i> > group. I do not know how I solved ( in fact, it started to work once I added +</I>><i> > i18n to the test_dyn group I created to test everything ). +</I>><i> +</I>><i> So it seems that's some caching issue ( or at least, I would inclined to think ). +</I>><i> If we modify mga-shell_access by hand, everything work fine. +</I>><i> Ie, any modification of the group is not reflected immediately, but on the next modification. +</I>><i> +</I>><i> Buchan, maybe you have a idea ? +</I>><i> ( already tried to play around indexes without much success ). +</I>><i> +</I>><i> According to the various researches I did around the web, dynlist + caching is a +</I>><i> hard problem, so maybe there is indeed a bug. +</I> +Turn out that the issue was more complex. +Since I was using ldapvi without -M option, the ldap search used returned all member: +attributes after being expanded by dynlist. So, upon closing the editor, it would +send the members attributes as change to apply to the group, and the ldap would record them +as a modification. This is why we were seeing some strange issue that I labeled as +'cache issue'. + +The command id is using a query with a search filter '(member=uid=login,dc=...)' and should not +have worked at all with dynlist, since dynamic group are expanded only when the whole +object is returned. Yet, because of the aformentioned side effect of ldapvi, it worked +but it was somehow "late" on change. + +After digging everywhere, the proper solution was much simpler : +- nss_ldap support nested groups. + +So I created a group mga-shell_access_2, placed the group of sysadmin, packagers, etc +in the members attribute and it worked fine. I did some basic tests to see there +was no regression and then I switched the group ( in 2 operations ). +And now it work fine. + +But this didn't seems to be widely documented ( or maybe I overlooked ) +-- +Michael Scherer +</PRE> + + + + + + + +<!--endarticle--> + <HR> + <P><UL> + <!--threads--> + <LI>Previous message: <A HREF="003393.html">[Mageia-sysadm] Dynlist and change on ldap +</A></li> + <LI>Next message: <A HREF="003398.html">[Mageia-sysadm] Beta 2 on mirror +</A></li> + <LI> <B>Messages sorted by:</B> + <a href="date.html#3396">[ date ]</a> + <a href="thread.html#3396">[ thread ]</a> + <a href="subject.html#3396">[ subject ]</a> + <a href="author.html#3396">[ author ]</a> + </LI> + </UL> + +<hr> +<a href="https://www.mageia.org/mailman/listinfo/mageia-sysadm">More information about the Mageia-sysadm +mailing list</a><br> +</body></html> |