1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE> [Mageia-sysadm] Dynlist and change on ldap
</TITLE>
<LINK REL="Index" HREF="index.html" >
<LINK REL="made" HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20Dynlist%20and%20change%20on%20ldap&In-Reply-To=%3C20110425174426.GA29647%40sisay.ephaone.org%3E">
<META NAME="robots" CONTENT="index,nofollow">
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<LINK REL="Previous" HREF="003393.html">
<LINK REL="Next" HREF="003398.html">
</HEAD>
<BODY BGCOLOR="#ffffff">
<H1>[Mageia-sysadm] Dynlist and change on ldap</H1>
<B>Michael scherer</B>
<A HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20Dynlist%20and%20change%20on%20ldap&In-Reply-To=%3C20110425174426.GA29647%40sisay.ephaone.org%3E"
TITLE="[Mageia-sysadm] Dynlist and change on ldap">misc at zarb.org
</A><BR>
<I>Mon Apr 25 19:44:26 CEST 2011</I>
<P><UL>
<LI>Previous message: <A HREF="003393.html">[Mageia-sysadm] Dynlist and change on ldap
</A></li>
<LI>Next message: <A HREF="003398.html">[Mageia-sysadm] Beta 2 on mirror
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#3396">[ date ]</a>
<a href="thread.html#3396">[ thread ]</a>
<a href="subject.html#3396">[ subject ]</a>
<a href="author.html#3396">[ author ]</a>
</LI>
</UL>
<HR>
<!--beginarticle-->
<PRE>On Mon, Apr 25, 2011 at 02:58:05PM +0200, Michael scherer wrote:
><i> On Mon, Apr 25, 2011 at 12:12:59PM +0200, Michael scherer wrote:
</I>><i> > On Thu, Apr 21, 2011 at 10:09:34PM +0200, Michael Scherer wrote:
</I>><i> > > Le jeudi 21 avril 2011 à 22:04 +0200, Michael Scherer a écrit :
</I>><i> > >
</I>><i> > > > To use it, just add a group like this :
</I>><i> > > >
</I>><i> > > > cn=mga-test_dyn,ou=Group,dc=mageia,dc=org
</I>><i> > > > cn: mga-test_dyn
</I>><i> > > > objectClass: posixGroup
</I>><i> > > > objectClass: groupOfURLs
</I>><i> > > > gidNumber: 5013
</I>><i> > > > memberURL:
</I>><i> > > > <A HREF="ldap:///ou=People,dc=mageia,dc=org?dn?sub?(&(objectClass=posixAccount">ldap:///ou=People,dc=mageia,dc=org?dn?sub?(&(objectClass=posixAccount</A>)(memberOf=cn=mga-council,ou=Group,dc=mageia,dc=org))
</I>><i> > > > memberURL:
</I>><i> > > > <A HREF="ldap:///ou=People,dc=mageia,dc=org?dn?sub?(&(objectClass=posixAccount">ldap:///ou=People,dc=mageia,dc=org?dn?sub?(&(objectClass=posixAccount</A>)(memberOf=cn=mga-sysadmin,ou=Group,dc=mageia,dc=org))
</I>><i> > > >
</I>><i> > > > This one will create a group with sysadmin and council member.
</I>><i> > > >
</I>><i> > > > # getent group mga-test_dyn
</I>><i> > > > mga-test_dyn:*:5013:misc,rda,boklm,tmb,ennael,dams,buchan,dmorgan,nanardon,colin,blino,pterjan
</I>><i> > > >
</I>><i> > > > ( ok here, it doesn't work fully, wobo and trishf42 are missing but
</I>><i> > > > since ennael and rda are not in sysadmin group, this kinda work, I will
</I>><i> > > > look at this more closely, maybe a index issue, or memberOf not being
</I>><i> > > > refreshed )
</I>><i> > >
</I>><i> > > Ok as usual, I first say something stupid and then find the issue.
</I>><i> > >
</I>><i> > > Of course, for this example, we should not add
</I>><i> > > "(objectClass=posixAccount)" in the filter, as neither wobo or trishf42
</I>><i> > > have a posixAccount :)
</I>><i> >
</I>><i> > So I finally made the changes to ldap :
</I>><i> > created a group called mga-shell_access
</I>><i> > changed svn acl for that
</I>><i> >
</I>><i> > the only issue that I faced was that some members ( ie all i18n and me ) were
</I>><i> > not able to use the svn, as "id $login" didn't show that they were in the
</I>><i> > group. I do not know how I solved ( in fact, it started to work once I added
</I>><i> > i18n to the test_dyn group I created to test everything ).
</I>><i>
</I>><i> So it seems that's some caching issue ( or at least, I would inclined to think ).
</I>><i> If we modify mga-shell_access by hand, everything work fine.
</I>><i> Ie, any modification of the group is not reflected immediately, but on the next modification.
</I>><i>
</I>><i> Buchan, maybe you have a idea ?
</I>><i> ( already tried to play around indexes without much success ).
</I>><i>
</I>><i> According to the various researches I did around the web, dynlist + caching is a
</I>><i> hard problem, so maybe there is indeed a bug.
</I>
Turn out that the issue was more complex.
Since I was using ldapvi without -M option, the ldap search used returned all member:
attributes after being expanded by dynlist. So, upon closing the editor, it would
send the members attributes as change to apply to the group, and the ldap would record them
as a modification. This is why we were seeing some strange issue that I labeled as
'cache issue'.
The command id is using a query with a search filter '(member=uid=login,dc=...)' and should not
have worked at all with dynlist, since dynamic group are expanded only when the whole
object is returned. Yet, because of the aformentioned side effect of ldapvi, it worked
but it was somehow "late" on change.
After digging everywhere, the proper solution was much simpler :
- nss_ldap support nested groups.
So I created a group mga-shell_access_2, placed the group of sysadmin, packagers, etc
in the members attribute and it worked fine. I did some basic tests to see there
was no regression and then I switched the group ( in 2 operations ).
And now it work fine.
But this didn't seems to be widely documented ( or maybe I overlooked )
--
Michael Scherer
</PRE>
<!--endarticle-->
<HR>
<P><UL>
<!--threads-->
<LI>Previous message: <A HREF="003393.html">[Mageia-sysadm] Dynlist and change on ldap
</A></li>
<LI>Next message: <A HREF="003398.html">[Mageia-sysadm] Beta 2 on mirror
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#3396">[ date ]</a>
<a href="thread.html#3396">[ thread ]</a>
<a href="subject.html#3396">[ subject ]</a>
<a href="author.html#3396">[ author ]</a>
</LI>
</UL>
<hr>
<a href="https://www.mageia.org/mailman/listinfo/mageia-sysadm">More information about the Mageia-sysadm
mailing list</a><br>
</body></html>
|
