Issue #1256: Document the expectations about ghost users showing in the lookups - sssd

SSSD / sssd

#1256 Document the expectations about ghost users showing in the lookups

Closed: Fixed None Opened 12 years ago by dpal.

See ticket #1255 for the design of the new approach of dealing with fake/ghost users. There are some situations when fake/ghost users are removed from child groups but would still show up as a member of the parent group. It might look confusing and might cause some unnecessary bugs and tickets filed. To prevent this we need to clearly articulate how things would work with the new approach and what to expect.

sgallagh commented 12 years ago

It should also be made clear that this behavior will be only cosmetic. When the real user in question logs in (and thus an {{{initgroups()}}} call is made), these ghost entries will disappear. There should be no actual permission error, unless someone is relying on the list of users in a group for an access-control decision instead of asking whether a user is a member of that group (subtle, but important distinction).

description: See ticket #1255 for the design of the new approach of dealing with fake/ghost users. There are some situations when fake/ghost users are removed form child groups but would still show up as a member of the parent group. It might look confusing and might cause some unnecessary bugs and tickets filed. To prevent this we need to clearly articulate how things would work with the new approach and what to expect. => See ticket #1255 for the design of the new approach of dealing with fake/ghost users. There are some situations when fake/ghost users are removed from child groups but would still show up as a member of the parent group. It might look confusing and might cause some unnecessary bugs and tickets filed. To prevent this we need to clearly articulate how things would work with the new approach and what to expect.
type: enhancement => task