Bug 57259 – Race condition in group changes, is adding already removed group members

Bug 57259 - Race condition in group changes, is adding already removed group members


Summary:	Race condition in group changes, is adding already removed group members

Status:	NEW

Product:	UCS
Classification:	Unclassified
Component:	AD Connector
Version:	UCS 5.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Samba maintainers
QA Contact:	Samba maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2024-05-07 11:11 CEST by Jürn Brodersen
Modified:	2024-05-07 11:19 CEST (History)
CC List:	0 users

See Also:	56581
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
reproduce (1.42 KB, application/x-shellscript) 2024-05-07 11:11 CEST, Jürn Brodersen	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Jürn Brodersen

2024-05-07 11:11:53 CEST

Created attachment 11205 [details]
reproduce

For bug 56581 I was investigating quick group changes. Adding a member and quickly removing it again from a group.

It looks like under some conditions group members are added to a group again even though they were removed.

The problem seems to boil down to the following scenario:
- Add a member to a group in a large sync from ucs transaction
- After the ad connector switches to the sync to ucs part, remove the member again. This needs to happen while the ad connector is in the sync to ucs part but before the ad connector is processing the member add action originally triggered in the previous step.

See the attached script to reproduce this. The ad connector log level needs to be in debug mode. You might need to run it a few times and check the group in the ad. Sometimes the members got out of sync?