Bug 57259 - Race condition in group changes, is adding already removed group members
Summary: Race condition in group changes, is adding already removed group members
Status: NEW
Alias: None
Product: UCS
Classification: Unclassified
Component: AD Connector
Version: UCS 5.0
Hardware: Other Linux
: P5 normal
Target Milestone: ---
Assignee: Samba maintainers
QA Contact: Samba maintainers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-05-07 11:11 CEST by Jürn Brodersen
Modified: 2024-11-21 09:15 CET (History)
1 user (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 5: Major Usability: Impairs usability in key scenarios
Who will be affected by this bug?: 1: Will affect a very few installed domains
How will those affected feel about the bug?: 3: A User would likely not purchase the product
User Pain: 0.086
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments
reproduce (1.42 KB, application/x-shellscript)
2024-05-07 11:11 CEST, Jürn Brodersen
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jürn Brodersen univentionstaff 2024-05-07 11:11:53 CEST
Created attachment 11205 [details]
reproduce

For bug 56581 I was investigating quick group changes. Adding a member and quickly removing it again from a group.

It looks like under some conditions group members are added to a group again even though they were removed.

The problem seems to boil down to the following scenario:
- Add a member to a group in a large sync from ucs transaction
- After the ad connector switches to the sync to ucs part, remove the member again. This needs to happen while the ad connector is in the sync to ucs part but before the ad connector is processing the member add action originally triggered in the previous step.

See the attached script to reproduce this. The ad connector log level needs to be in debug mode. You might need to run it a few times and check the group in the ad. Sometimes the members got out of sync?