[389-users] Re: memberOf Plugin report inconsistent states

On 7/15/21 9:21 AM, Thierry Bordaz wrote:

On 7/15/21 2:56 PM, Tobias Ernstberger wrote:

Hello,

it is well known and documented, that the memberOf attribute can have inconsistent states (e.g. by manipulating it directly).
There is also a Fix-Up Task to repair that.

Question: Is there also a way to report/list all current inconsistent states, that the Fix-Up Task might repair?

Hello,

No it does not check if there are differences between old/new memberof values. It just replace the old valueset with the new one.

We have a similar feature with auto member plugin.  There is a task that will report what it "would" do if it was run,  There is another task that will generate a LDIF file of then changes it would do.

https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/administration_guide/advanced_entry_management#automember-tasks-tests

Something like this could possibly be done with memberOf, but it would need more investigation.

Mark

Motivation for that is to evaluate the impact of the Fix-Up Task to reduce/manage operational risks.
Possible action might be to evaluate manually for all reported issues if they need to be cleaned up in the memberOf attribute, or added as regular group membership to the group 

Do you mean you would like an option to run the fixup task  to report invalid memberof setting but without doing any update ? Then later do the manual fixup ?

best regards
thierry

Mit freundlichen Grüßen / Kind regards

Tobias Ernstberger
IT-Architect Identity and Access Management
IBM Security Expert Labs
+49 151 15138929
tobias.ernstberger@de.ibm.com

IBM Security

IBM Deutschland GmbH
Vorsitzender des Aufsichtsrats: Sebastian Krause
Geschäftsführung: Gregor Pillen (Vorsitzender), Agnes Heftberger, Gabriele Schwarenthorer, Markus Koerner, Christian Noll, Nicole Reimer
Sitz der Gesellschaft: Ehningen / Registergericht: Amtsgericht Stuttgart, HRB 14562 / WEEE-Reg.-Nr. DE 99369940
https://www.ibm.com/privacy/us/en/

_______________________________________________  389-users mailing list -- 389-users@lists.fedoraproject.org  To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines  List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure  

_______________________________________________  389-users mailing list -- 389-users@lists.fedoraproject.org  To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines  List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure  

--   Directory Server Development Team