Registered: 2003-05-07
Posts: 273
Loc: Sydney, Australia
Dear Ruud et. al., I have come across a bug with InGroup. The token cache seems to have a limit of 64 domain groups. Once the limit has been reached, no more groups are recorded. This results in InGroup sometimes returning 0 when it should return 1. I have tested this by removing membership from some groups and found that new groups appear up to the 64 group limit. InGroup is an important function that is used by many and I therefore rate this as a serious bug that needs to be urgently addressed. Regards, Richard
Registered: 2003-05-07
Posts: 273
Loc: Sydney, Australia
In that case, I'm very confused. Can anyone explain the behaviour I have observed? There definitely seems to be a limit on the XP machines I have tested on, as when I remove a user from some group, it disappears from the token cache and another group that the user is member of appears in its place.
Certainly, the token cache isn't listing all the valid group memberships in these instances and Ingroup returns 0 when it should return 1. I will do some more testing. Maybe I have jumped to the incorrect explanation but there is certainly an issue related to InGroup.
Registered: 2003-05-07
Posts: 273
Loc: Sydney, Australia
OK, it seems I did jump to the wrong conclusion. 64 does not seem to be a limit, a user who is having this issue had that many items in his token cache. Because items appeared after removing group membership and because 64 is a multiple of 2, I assumed it was a limit of a hashing function.
Something strange is going on here.... the problem seems to be limited to a couple of machines and so it is probably a bug with them. I'll keep on looking into it.
Registered: 2003-05-07
Posts: 273
Loc: Sydney, Australia
Something must have changed because the problem has disappered on the machines that were displaying the problem.
On 2 Windows 98 virtual machines however, a group that is detected on other OS's is never detected for any user, whilst other universal security groups groups are. I know Windows 98 SE machines don't use a token cache so maybe that is telling of something?
Registered: 1999-05-06
Posts: 391
Loc: Amsterdam, The Netherlands
Well, there is no built-in limit (in Kixtart) to the number of groups you can have in the cache. If you can somehow repro the problem on one of your systems, please let me know.
As for Windows 9x, groups are retrieved (very) different from the process on NT and up and there are various limitations in the underlying API's. Still, if you use KXRPC, you should be able to get all groups.