URL:
https://github.com/SSSD/sssd/pull/374
Author: justin-stephenson
Title: #374: IPA: Add threshold for sudo command and command group searches
Action: opened
PR body:
"""
In large IPA environments where a high number of sudo commands and command groups are
used, retrieval of sudo data can lead to SSSD constructing an overly large search filter
which is not handled well on the ns-slapd side.
This PR implements a threshold by adding the `ipa_sudo_command_threshold` option(defaults
to 50) which is used to prevent the large search filter from being created, an idea
similar to
https://github.com/SSSD/sssd/pull/319
Additionally, a commit was added to rename the **sudo_threshold** option to
**sudo_rules_threshold**. This can be dropped if it seems unnecessary but I thought I
would add it.
This can be reproduced by adding more sudo commands/command groups than the defined
`ipa_sudo_command_threshold` in sssd.conf and checking the search filter used in the
domain log or dirsrv access logs. If the threshold is not exceeded, the searches will
still include the sudo command groups and command groups in the search filter.
I tested this on both the IPA server and IPA client by verifying sudo commands work as
expected when the threshold is exceeded for IPA and AD trust users, and `sudo -l` command
is the same as before the patch.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/374/head:pr374
git checkout pr374