[Simo Sorce]
Do I miss any scenario ?
I suspect you missed the scenario we have here at the University of
Oslo. We have a LDAP directory (OpenLDAP) with ~120k users, and
groups with 20-30k members using rfc2307 classic schema with memberUid
attributes. But user searches are limited, and will not return
anything if more than some thousand objects are found (not sure but
believe the limit is 5000). So looping over all users is not
possible. The algorithm chosen should not assume it is possible to
look up all objects in LDAP.
When trying to log in using sssd 1.2.1 for a user that is a member of
one of the large groups (25k members), logging in take several
minutes. :/
We have not found time to test the latest versions yet. It is slowly
making its way up to the top of our todo lists. :)
Happy hacking,
--
Petter Reinholdtsen