On Mon, Jun 02, 2014 at 10:10:20AM +0200, Jakub Hrozek wrote:
On Fri, May 30, 2014 at 06:09:13PM +0200, Sumit Bose wrote:
> Hi,
>
> I have summarized a thread on this list and added some additional
> information on
>
https://fedorahosted.org/sssd/wiki/DesignDocs/NSSWithKerberosPrincipal
>
> For your convenience the text can be found below as well. Comments and
> suggestions are welcome.
>
> bye,
> Sumit
Very nice design page!
I fixed some typos while I was going through the text.
One question about the cache lookups -- do you plan on looking up the
user names in all domains first and then principals:
for dom in domain:
getpwnam(input)
if not match:
for dom in domain:
get_user_by_princ(input)
or look up name and principal before moving on to the next domain?
for dom in domain:
getpwnam(input)
if not match:
get_user_by_princ(input)
Currently my idea was the first one to not change the existing behaviour
too much.
But if we start to optimize the NSS responder at some point to search
the cache for all domains first and only reach out to the backend if
nothing was found in chache for any domain, we might want to fold the
principal lookup in the cache lookups.
bye,
Sumit
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel