-----BEGIN PGP SIGNED MESSAGE-----
On 10/04/2010 07:38 AM, Petter Reinholdtsen wrote:
> Not for the sake of being argumentative, but for the sake of
> completeness, why do you want to change the semantics of what an
> admin would expect? Especially when most people using sssd are
> former pam_ldap users and expect things like netgroups to work a
> certain way? While not disagreeing, I'm just curious as to the
We use netgroups in NIS and LDAP here at the University of Oslo, and
we expect netgroups to behave as they always have, no matter the
supplier (nis, ldap or sss :).
I use netgroups in /etc/netgroups when I need to debug stuff, to be
able to quickly change their values before pushing the final version
into our admin too (which is used to populate NIS and LDAP). So to
me, it would be a surprise if /etc/nsswitch.conf was ignored when it
come to netgroup sources and glibc was not the one in charge of
expanding recursive netgroups. If I did not want to consult local
files, I would list 'netgroup: sss' instead of 'netgroup files sss' in
Yes, we've made our final decision that, instead of trying to improve
our performance, we are simply going to throw the nested group names
over the wall to glibc and let it sort it out.
We lose the ability to limit nesting levels and do loop-detection in
this case, however. We just have to trust that glibc is sane.
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----