[SSSD-users] ad_access_filter and splitting group listing with backslash

2018-09-25 Thread TomK
Hey All, Given this example below which spans the entire line: ad_access_filter = (|(memberOf=CN=group-of -admins,OU=XYZ,DC=blah,DC=blah,DC=blah)(memberOf=CN=group-of -managers,OU=XYZ,DC=blah,DC=blah,DC=blah)(memberOf=CN=group-of -minions,OU=XYZ,DC=blah,DC=blah,DC=blah)(memberOf=CN=group-of

[SSSD-users] Re: Issues with SSSD cache on version 1.13.4

2018-09-25 Thread Simo Sorce
On Tue, 2018-09-25 at 08:40 +0200, Jakub Hrozek wrote: > > On 24 Sep 2018, at 20:25, Simo Sorce wrote: > > > > On Mon, 2018-09-24 at 19:59 +0200, Jakub Hrozek wrote: > > > On Mon, Sep 24, 2018 at 10:22:35AM -0400, Simo Sorce wrote: > > > > > btw it’s a good question to ask why isn’t the check

[SSSD-users] System Error

2018-09-25 Thread Alfredo De Luca
Hi all. I run an SFTP server with Centos 7.4 with freeIPA and sssd. There is a user that can connect no problem manually...but with a polling application (I think is ListSFTP) I can see polling a lot of directories... but all of sudden we receive Sep 25 11:09:22 sftp sshd[12281]:

[SSSD-users] Re: Issues with SSSD cache on version 1.13.4

2018-09-25 Thread Michael Ströder
On 9/25/18 8:40 AM, Jakub Hrozek wrote: > This is honestly something where I don’t know what is the right thing > to do. If we detect that a group with some GID already exists, then > how do we distinguish between “err, there are duplicates on the LDAP > side” and “look, the group was renamed”

[SSSD-users] Re: Issues with SSSD cache on version 1.13.4

2018-09-25 Thread Jakub Hrozek
> On 24 Sep 2018, at 20:25, Simo Sorce wrote: > > On Mon, 2018-09-24 at 19:59 +0200, Jakub Hrozek wrote: >> On Mon, Sep 24, 2018 at 10:22:35AM -0400, Simo Sorce wrote: btw it’s a good question to ask why isn’t the check done on saving the group. I thought it was and I see code that

[SSSD-users] Re: Issues with SSSD cache on version 1.13.4

2018-09-25 Thread Sumit Bose
On Mon, Sep 24, 2018 at 06:52:50PM +, Beale (US), Gareth wrote: > >The way the code is currently written is, if there is a duplicate: > >- check if the "new" group has the same SID, uniqueID or original DN > > as the "old" one > > - yes, same: this is a rename, allow > > -