-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/06/2010 12:00 PM, Patrik Martinsson wrote:
Ah ok, cool i hear you.
I reccon we need to have the enumeration option, it's really handy to
lookup users that way, we have done it for so along time (And god forbid
to change things, right ;)).
I found the option enum_cache_timeout, which defaults to 120 seconds,
which means if i understand it right that it will refresh the enum_cache
(thus enumrate the ad) every
120 seconds, which seems to be overkill in my opinion.
Actually, there seems to be a bug in our documentation. There are two
parameters that affect enumeration:
enum_cache_timeout - how long will entries in cache be valid. That is,
if you do two enumerations within the enum_cache_timeout interval, the
second one will go from cache.
ldap_enumeration_refresh_timeout - This parameter is missing from the
sssd-ldap manual page. I will send a patch that adds it. It affects how
often the LDAP provider schedules enumerations. The default value is 300
(seconds, so 5 minutes).
Hmm, this is a bit tricky to have it the way i want i guess,
#1, I want sssd to cache user info to be able to login offline.
Keep in mind you also need to set cache_credentials to true for offline
logins to work.
#2, Although when I do a getent passwd I would like a fresh list from
the AD, (like nss/ldap did it)
If you need to fetch the enumeration data always from the directory, but
prevent automatic enumeration updates from running in background until
told, then I would set a very low enum_cache_timeout and reasonably high
ldap_enumeration_refresh_timeout.
#3, However when a user login I do not want to wait for sssd to
enumarate the AD (taking alot of time)
When a user logs in, there is no enumeration done. Perhaps initgroups
(which might pull a reasonable amount of data), but no enumeration.
I'm thinking of following setup/scenario.
#1, I set enum_cache option to 999999 or whatever so sssd only
enumerates at start, because it does that right ? Then i would have a
fresh sssd cache at start.
#2, Then some user gets added to the AD.
#3, I try to find that user, getent passwd | grep email (couse i just
know his name, not the username) and i wont find that user, since
sssd-cache thats being returned doesnt contain that user.
I guess i need to figure out some other way of working maybe.
/Patrik
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkxb6LQACgkQHsardTLnvCWAEQCeKqrmqcvYSrAkryxrX629m/dp
tz4AnjJ8Hs64wJTKQnkJ+Pe2IahxpKvL
=Mcsm
-----END PGP SIGNATURE-----