[Freeipa-devel] [PATCH] 404 ensure priority is unique

[Rob Crittenden]

Pavel Zůna wrote:
> Rob Crittenden wrote:
>> Pavel Zuna wrote:
>>> Jason Gerard DeRose wrote:
>>>> On Fri, 2010-03-12 at 18:01 -0500, Rob Crittenden wrote:
>>>>> Ensure that the group policy priority is unique.
>>>>>
>>>>> We use CoS to determine the order in which group policy is applied. 
>>>>> The behavior in CoS is undefined for multiple entries with the same
>>>>> cospriority.
>>>>>
>>>>> This likely relies on some other outstanding pwpolicy patches.
>>>>>
>>>>> rob
>>>>
>>>> ack.  pushed to master.
>>>>
>>> The patch works, but I find the way it checks for priority uniqueness 
>>> highly ineffective. It pulls out all policies and then retrieves 
>>> their CoS entries one by one to do the checking. Instead it should 
>>> just make a search for a CoS entry with the given priority.
>>>
>>> Pavel
>>
>> Well, we may need to store the group policy entries in a subtree then. 
>> All CoS policies are currently dumped into the same place making this 
>> impossible.
> Not necessarily. It's just a matter of tweaking the search filter. We 
> can search only for CoS entries, that have the krbContainer object class 
> and their krbPwdReference attribute contains a group DN.

Oh right, duh. Yeah, it is even simpler than that as we don't need to 
look at group dns because only group policy is stored this way.

New patch attached.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-404-2-pwpolicy.patch
Type: application/mbox
Size: 8259 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20100322/221be0a2/attachment.mbox>