On Wed, Sep 07, 2016 at 02:57:15PM +0300, Nikolai Kondrashov wrote:
On 08/29/2016 11:47 PM, Sumit Bose wrote:
> Finally you call sysdb_initgroups_with_views() to get the list of groups
> the user is a member of and compare them with the groups form the
> session_recording configuration. Since you compare the DNs I think this
> can be improved a bit. sysdb_initgroups_with_views() does a dereference
> search based on the memberOf attribute of the user which holds the DNs
> of all the groups the user is a member of. But since you only need
> the DNs of the groups for the comparison you can just add the memberOf
> attribute to the attribute list in nss_cmd_getpwnam_search() and friends
> to make the DNs of the groups available in
> session_recording_is_enabled().
And one more question: the above basically means that we need to make
sysdb_getpwnam retrieve "memberOf" as well. Do we want to do that?
If yes, do we want to do that unconditionally, or change the interface to have
that optional (ugh)?
It might be better to not do it unconditionally because it might cause
some unwanted processing and memory allocations. A new
sysdb_getpwnam_ex() call with new parameter for the needed attributes
might work. But as with your other questions, all this might not be
needed if a session recording attribute as suggested by Simo can be
used. Then only this attribute must be added to the default list of
sysdb_getpwnam().
bye,
Sumit
>
> Do we want to change sysdb_enumpwent_filter (used in setpwent) to do that as
> well?
>
> We went through some of this in a chat a while ago, but I just want to be
> sure.
>
> Thanks!
>
> Nick
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org