On 05/04/2012 11:25 AM, Rich Megginson wrote:
This came up during extended testing for
https://fedorahosted.org/389/ticket/355
steps:
1) make a ds user and an ad user that are in sync - verify ad changes
go to ds and vice versa
2) move the ad user out of scope of the sync agreement
3) verify that sync is not working - verify ad changes don't go to ds
and vice versa
4) delete the ad user - the ds user is also deleted
Before the fix for ticket 355, moving the AD entry out of scope would
delete the DS entry - but that was problematic - if you mis-configured
your sync agreement, all of your DS users could be accidentally deleted
This seems counter-intuitive - the entries are not in sync, yet the
deletion is synced. This is because we do not look at the scope of
the AD tombstone entry prior to deletion, and test it using
is_subject_of_agreement_remote(e,prp->agmt)
We could look at the AD tombstone to see if was in scope - the AD
tombstone (with 2008 anyway) provides the attribute "lastknownparent":
(gdb) p *e->e_attrs->a_next->a_next->a_next->a_next->a_next
$27 = {a_type = 0x7fffc0056bb0 "lastknownparent", a_present_values = {
va = 0x7fffc00563b0}, a_flags = 4, a_plugin = 0x6c85a0,
a_deleted_values = {va = 0x0}, a_listtofree = 0x0, a_next =
0x7fffc0059450,
a_deletioncsn = 0x0, a_mr_eq_plugin = 0x690240, a_mr_ord_plugin = 0x0,
a_mr_sub_plugin = 0x0}
(gdb) p
*e->e_attrs->a_next->a_next->a_next->a_next->a_next->a_present_values.va[0]
$28 = {bv = {bv_len = 36,
bv_val = 0x7fffc0067470 "CN=deletedusers,DC=testdomain,DC=com"},
v_csnset = 0x0, v_flags = 0}
So, in this case, if we used lastknownparent, we would see that the
entry was outside of the scope of the agreement (the sync subtree is
cn=testusers,dc=testdomain,dc=com).
Question: In light of 355 changing the behavior - should we use
lastknownparent to see if the tombstone is out of the scope of the
agreement, and not delete the DS entry if so?
Also note:
1) When we sync deletes from DS to AD, we _do_ check to see if the entry
is within the sync scope.
2) When we move a DS entry out of scope, we still delete the
corresponding AD entry - should we change this behavior too?
--
389-devel mailing list
389-devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-devel
--
389-devel mailing list
389-devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-devel
