[Freeipa-devel] [PATCH] 19 Cleanup for netgroup search

[Rob Crittenden]

Jan Zeleny wrote:
> JR Aquino<JR.Aquino at citrix.com>  wrote:
>> On 2/17/11 3:23 AM, "Jan Zelený"<jzeleny at redhat.com>  wrote:
>>> JR Aquino<JR.Aquino at citrix.com>  wrote:
>>>> This patch fixes the netgroup plugin's behavior of adding duplicate
>>>>
>>>> entries
>>>>
>>>> when the managed entry plugin creates a netgroup with a mepManagedEntry
>>>> This problem is documented in ticket:
>>>> https://fedorahosted.org/freeipa/ticket/963
>>>>
>>>> As noted by Endi for issue #3 in the History:
>>>> "3. Just out of curiosity, I tried adding a netgroup with the same name
>>>>
>>>> as
>>>>
>>>> the hostgroup. I expected it to conflict with the managed netgroup, but
>>>>
>>>> it
>>>>
>>>> actually worked. Searching the directory will return 2 netgroups with
>>>>
>>>> the
>>>>
>>>> same name:"
>>>>
>>>> Historically the netgroup plugin had inappropriately defined:
>>>> rdn_attribute
>>>>
>>>> = 'ipauniqueid' This caused the ability of duplication with the creation
>>>> of native netgroups using the ipaUniqueId as the DN and as the Managed
>>>> Entry netgroups utilizing the cn as the DN.
>>>>
>>>> Patch includes adjustments for the netgroup plugin and corresponding
>>>> test_netgroup_plugin
>>>>
>>>> Please verify that the items requested in #963 are now complete and
>>>>
>>>> please
>>>>
>>>> confirm that the corresponding tests all pass.
>>>
>>> One test fails:
>>> FAIL: test_netgroup[30]: netgroup_remove_member: Remove netgroup
>>> u'netgroup2'
>> >from netgroup u'netgroup1'
>>>
>>> Command ipa host-show still shows:
>>> Member of netgroups: testhostgroup
>>>
>>> Also a little bit of nitpicking, I think the changed code in chunk 2
>>> would
>>> better look something like this:
>>>
>>> search_kw = {}
>>> search_kw['objectclass'] = ['mepManagedEntry']
>>>
>>> if not options['private']:
>>>     local_filter = ldap.make_filter(search_kw, rules=ldap.MATCH_NONE)
>>>
>>> else:
>>>     local_filter = ldap.make_filter(search_kw, rules=ldap.MATCH_ALL)
>>>
>>> filter = ldap.combine_filters((local_filter, filter),
>>> rules=ldap.MATCH_ALL)
>>>
>>> --
>>> Jan
>>
>> It was determined that the ipauniqueid is required for the DN on these
>> objects.
>> It's an ipaAssociation which uses it as the rdn, if we change the problems
>> cascade
>>
>> This patch has now changed to reflect the optimization in the netgroup
>> search instead.
>> It provides a cleaner method of performing a netgroup search for native
>> netgroups and allows for the --private search to only display the
>> mepManagedEntry netgroups, rather than ALL netgroups. Previously --private
>> would return ALL netgroups.
>>
>> This means there is no need to modify test_netgroup_plugin.
>>
>> Please verify that the optimization / bugfix passes the standard
>> test_netgroup_plugin.
>
> Ack
>
> Jan

pushed to master