Bug 1473572 - Make changes in overrides available in the compat tree at runtime
Make changes in overrides available in the compat tree at runtime
Status: VERIFIED
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: slapi-nis (Show other bugs)
7.3
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Alexander Bokovoy
ipa-qe
:
Depends On:
Blocks: 1420851 1472344
  Show dependency treegraph
 
Reported: 2017-07-21 03:59 EDT by Sumit Bose
Modified: 2018-01-18 00:29 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Sumit Bose 2017-07-21 03:59:58 EDT
Currently a change in an override is only in the compat tree after a restart of 389ds.

There seems to be a possibility to improve this and make the changes available at runtime.
Comment 11 Sudhir Menon 2018-01-18 00:29:37 EST
Tested on RHEL7.5 Beta using

ipa-server-4.5.4-8.el7.x86_64
sssd-1.16.0-14.el7.x86_64
389-ds-base-1.3.7.5-11.el7.x86_64

[root@master ~]# ipa group-add idmgroupstestext0002 --external
----------------------------------
Added group "idmgroupstestext0002"
----------------------------------
  Group name: idmgroupstestext0002
[root@master ~]# ipa group-add idmgroupstest0002
-------------------------------
Added group "idmgroupstest0002"
-------------------------------
  Group name: idmgroupstest0002
  GID: 1896600013
[root@master ~]# ipa group-add-member idmgroupstest0002 --groups=idmgroupstestext0002
  Group name: idmgroupstest0002
  GID: 1896600013
  Member groups: idmgroupstestext0002
-------------------------
Number of members added 1
-------------------------

[root@master ~]# ipa group-add-member idmgroupstestext0002 --external=aduser1@pne.qe
[member user]: 
[member group]: 
  Group name: idmgroupstestext0002
  External member: S-1-5-21-2202318585-426110948-4011710778-5281
  Member of groups: idmgroupstest0002
-------------------------
Number of members added 1
-------------------------
[root@master ~]# date ; sss_cache -u aduser1@pne.qe
Thu Jan 18 10:36:17 IST 2018

[root@master ~]# date ; id aduser1@pne.qe
Thu Jan 18 10:36:25 IST 2018
uid=1261605281(aduser1@pne.qe) gid=1261605281(aduser1@pne.qe) groups=1261605281(aduser1@pne.qe),1261600513(domain users@pne.qe),1261602139(adunigroup1@pne.qe),1261601559(adgroup1@pne.qe),1261601629(adgroup2@pne.qe),1896600007(idmgroupstest0002)

[root@master ~]# date ; getent group idmgroupstest0002@sdr2k16.test
Thu Jan 18 10:36:37 IST 2018
idmgroupstest0002:*:1896600007:aduser1@pne.qe

[root@master ~]# date ; ldapsearch -ZZ -h master.sdr2k16.test -D "cn=directory manager" -w Secret123 -b "cn=compat,dc=sdr2k16,dc=test" -s sub "(&(cn=idmgroupstest0002))"
Thu Jan 18 10:37:15 IST 2018
# extended LDIF
#
# LDAPv3
# base <cn=compat,dc=sdr2k16,dc=test> with scope subtree
# filter: (&(cn=idmgroupstest0002))
# requesting: ALL
#

# idmgroupstest0002, groups, compat, sdr2k16.test
dn: cn=idmgroupstest0002,cn=groups,cn=compat,dc=sdr2k16,dc=test
objectClass: posixGroup
objectClass: ipaOverrideTarget
objectClass: extensibleObject
objectClass: top
gidNumber: 1896600013
ipaAnchorUUID:: OklQQTpzZHIyazE2LnRlc3Q6NDFkMmRiMmMtZmMwZC0xMWU3LThiNDctNTI1ND
 AwZWE2NWE1
cn: idmgroupstest0002
memberUid: aduser1@pne.qe <== member is reflected without dirsrv restart.

Note: There has been another bz1535547 for the issue 'External members of an external group aren't resolved when initially populating the compat tree".
Hence marking this bug as VERIFIED.

Note You need to log in before you can comment on or make changes to this bug.