Ah ok, cool i hear you.
I reccon we need to have the enumeration option, it's really handy to
lookup users that way, we have done it for so along time (And god forbid
to change things, right ;)).
I found the option enum_cache_timeout, which defaults to 120 seconds,
which means if i understand it right that it will refresh the enum_cache
(thus enumrate the ad) every
120 seconds, which seems to be overkill in my opinion.
Hmm, this is a bit tricky to have it the way i want i guess,
#1, I want sssd to cache user info to be able to login offline.
#2, Although when I do a getent passwd I would like a fresh list from
the AD, (like nss/ldap did it)
#3, However when a user login I do not want to wait for sssd to
enumarate the AD (taking alot of time)
I'm thinking of following setup/scenario.
#1, I set enum_cache option to 999999 or whatever so sssd only
enumerates at start, because it does that right ? Then i would have a
fresh sssd cache at start.
#2, Then some user gets added to the AD.
#3, I try to find that user, getent passwd | grep email (couse i just
know his name, not the username) and i wont find that user, since
sssd-cache thats being returned doesnt contain that user.
I guess i need to figure out some other way of working maybe.
/Patrik
On 08/06/2010 11:30 AM, Jakub Hrozek wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/06/2010 11:18 AM, Patrik Martinsson wrote:
> So basically, what I'm wondering is, cant i have getent passwd returning
> all my users without having enumerate = true in the config ?
>
No, if you run "getent passwd" (without any specific user) you are doing
an enumeration and for that to work, you need to have the "enumerate"
parameter set to "true". As a side note, if you'd like to enumerate only
users served via SSSD, you can run "getent passwd -s sss" (asking only
for users from the nss_sss module).
Enumeration is not advised in large directories, but please note that
only the first enumeration would be slow as SSSD needs to pull the users
from the server. After that, if would return the entries from cache.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkxb1j8ACgkQHsardTLnvCXpQQCePCJSITrhp8oXVDIAxKU/O/nd
jl8Ani1WSjSzborNyk30Yx2uN6uQGKBE
=BfCS
-----END PGP SIGNATURE-----
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel