Bug 880159

Summary:	delete operation is not implemented for ghost users
Product:	Red Hat Enterprise Linux 6	Reporter:	Jakub Hrozek <jhrozek>
Component:	sssd	Assignee:	Jakub Hrozek <jhrozek>
Status:	CLOSED ERRATA	QA Contact:	Kaushik Banerjee <kbanerje>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.4	CC:	dpal, grajaiya, jgalipea, pbrezina, tlavigne
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	sssd-1.9.2-34.el6	Doc Type:	Bug Fix
Doc Text:	No documentation needed.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-02-21 09:41:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	886216

Description Jakub Hrozek 2012-11-26 11:40:41 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/1668

We propagate the ghost users within the nested group structure in order for the parent groups to inherit members from their siblings inside the memberof plugin. However, the memberof plugin does not implement the reverse operation - deleting the members when the sibling is removed from the directory.

This leads to users being reported as group members forever if their direct parent is removed from LDAP.

Steps to reproduce:
1. create two groups - mid and top
2. create a user
3. make the user a direct member of mid group
4. add the mid group as a member of top level group
5. getent group top
   -- you should see the user reported as a member
6. delete the mid group
7. sss_cache -g mid to speed force a lookup from LDAP next time
8. getent group mid to attempt the LDAP lookup
   -- the LDAP lookup will fail and will remove the group from the directory
9. getent group top

Expected:
mid is no longer present, so top should not contain mid's members

Actual:
top still contains the members inherited from mid

Comment 2 Kaushik Banerjee 2012-12-28 12:59:49 UTC

Verified in version 1.9.2-59

Report from beaker automation execution:
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: 2307bis_007 - bz 880159 - delete operation is not implemented for ghost users
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   LOG    ] :: Sleeping for 5 seconds
:: [   PASS   ] :: Running 'getent group mofuser5_grp_top | grep mof_user5'
:: [   PASS   ] :: Running 'sss_cache -g mofuser5_grp_mid'
:: [   PASS   ] :: Expected: mofuser5_grp_mid group lookup fails
:: [   PASS   ] :: Running 'getent group mofuser5_grp_top | grep -v mof_user5'
:: [   LOG    ] :: Duration: 11s
:: [   LOG    ] :: Assertions: 4 good, 0 bad
:: [   PASS   ] :: RESULT: 2307bis_007 - bz 880159 - delete operation is not implemented for ghost users

Comment 3 errata-xmlrpc 2013-02-21 09:41:13 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0508.html