-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
* [PATCH 1/2] AD: Detect domain controller compatibility version
This patch allows us to read the domain controller version from the
RootDSE, if it exists. This will be used by the next patch to
determine if the SSSD can use tokenGroups for lookups.
* [PATCH 2/2] AD: Optimize initgroups lookups with tokenGroups
If we are doing ID-mapped lookups, we can take advantage of the
AD-specific option "tokenGroups", which allows us to retrieve a
pre-flattened list of all the group SIDs for which this user is a
member. From this, we can convert them to GIDs and conclude the
initgroups() lookup with only two LDAP queries (the search for the
user and the base search for the user's tokengroups; the latter must
be performed as a base search due to restrictions imposed on the
tokenGroups attribute by AD).
When we save these groups to the sysdb, if the group is being seen for
the first time it will be temporarily given the name of the SID
representing it. Later, when we look it up by name or GID, this group
will be replaced with the real one.
Fixes
https://fedorahosted.org/sssd/ticket/1355
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla -
http://www.enigmail.net/
iEYEARECAAYFAlBbG2wACgkQeiVVYja6o6M9CQCdFwXQ2yBIlo7wPtJ4PAXW8Lt1
VLwAoINgdsNnq/2Z4Sl2KlQe68e3FXmJ
=uyEO
-----END PGP SIGNATURE-----