Bug 880159 - delete operation is not implemented for ghost users
Summary: delete operation is not implemented for ghost users
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sssd
Version: 6.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Jakub Hrozek
QA Contact: Kaushik Banerjee
URL:
Whiteboard:
Depends On:
Blocks: 886216
TreeView+ depends on / blocked
 
Reported: 2012-11-26 11:40 UTC by Jakub Hrozek
Modified: 2020-05-02 17:07 UTC (History)
5 users (show)

Fixed In Version: sssd-1.9.2-34.el6
Doc Type: Bug Fix
Doc Text:
No documentation needed.
Clone Of:
Environment:
Last Closed: 2013-02-21 09:41:13 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github SSSD sssd issues 2710 None None None 2020-05-02 17:07:24 UTC
Red Hat Product Errata RHSA-2013:0508 normal SHIPPED_LIVE Low: sssd security, bug fix and enhancement update 2013-02-20 21:30:10 UTC

Description Jakub Hrozek 2012-11-26 11:40:41 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/1668

We propagate the ghost users within the nested group structure in order for the parent groups to inherit members from their siblings inside the memberof plugin. However, the memberof plugin does not implement the reverse operation - deleting the members when the sibling is removed from the directory.

This leads to users being reported as group members forever if their direct parent is removed from LDAP.

Steps to reproduce:
1. create two groups - mid and top
2. create a user
3. make the user a direct member of mid group
4. add the mid group as a member of top level group
5. getent group top
   -- you should see the user reported as a member
6. delete the mid group
7. sss_cache -g mid to speed force a lookup from LDAP next time
8. getent group mid to attempt the LDAP lookup
   -- the LDAP lookup will fail and will remove the group from the directory
9. getent group top

Expected:
mid is no longer present, so top should not contain mid's members

Actual:
top still contains the members inherited from mid

Comment 2 Kaushik Banerjee 2012-12-28 12:59:49 UTC
Verified in version 1.9.2-59

Report from beaker automation execution:
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: 2307bis_007 - bz 880159 - delete operation is not implemented for ghost users
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   LOG    ] :: Sleeping for 5 seconds
:: [   PASS   ] :: Running 'getent group mofuser5_grp_top | grep mof_user5'
:: [   PASS   ] :: Running 'sss_cache -g mofuser5_grp_mid'
:: [   PASS   ] :: Expected: mofuser5_grp_mid group lookup fails
:: [   PASS   ] :: Running 'getent group mofuser5_grp_top | grep -v mof_user5'
:: [   LOG    ] :: Duration: 11s
:: [   LOG    ] :: Assertions: 4 good, 0 bad
:: [   PASS   ] :: RESULT: 2307bis_007 - bz 880159 - delete operation is not implemented for ghost users

Comment 3 errata-xmlrpc 2013-02-21 09:41:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0508.html


Note You need to log in before you can comment on or make changes to this bug.