I can also confirm that several services (Cadence, are you listening??) depend on
enumeration so we need preserve this functionality - but I agree that relying on
enumeration is a bad habit which should be avoided.
[mailto:email@example.com] On Behalf Of James Ralston
Sent: Wednesday, May 06, 2015 7:29 PM
To: End-user discussions about the System Security Services Daemon
Subject: [SSSD-users] please do not remove enumeration from AD provider
On Wed, May 6, 2015 at 4:27 AM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
You know, just this morning, I was thinking about enumeration. It
doesn't work for IPA views at all for example. It doesn't work for
trusted domains at all either (except for some limited support in AD
trusted domains that is very untested)
I wonder if we could just remove enumeration from IPA and AD back ends
in some major release.
Please don't do this.
Enumeration is a very useful feature. It allows us to do things like
$ getent passwd | grep -i lastname
The equivalent ldapsearch command is much more tedious:
$ ldapsearch -z 0 -E pr=2147483647/noprompt -o ldif-wrap=no -L -L -H
'ldap:///dc%3Dexample%2Cdc%3Dorg -Y GSSAPI -N -b "dc=example,dc=org"
"(&(objectClass=user)(cn=*lastname*))" dn cn sAMAccountName
More generically, enumeration is the way Unix/Linux has always worked.
Even getting users to change from:
grep -i lastname /etc/passwd
getent passwd | grep -i lastname
...has been a struggle.
We also have various services that (unfortuantely) pre-load the passwd and group files at
startup by enumerating them with getpwent_r() and getgrent_r(), instead of using the
get*nam_r() and get*id_r() functions as-needed. These services break outright if
enumeration is disabled.
(Yes, these services are broken. Yes, they shouldn't do that. But our ability to fix
them is extremely limited at best, because we don't control them.)
Finally, we have many systems that cannot be joined to Active Directory (for policy
reasons, not technical reasons). But we want to use the same passwd/group entries on
those systems as returned by sssd on hosts that are joined to Active Directory. We do
this by scraping the output of "getent -s sss passwd" and "getent -s sss
group" and manually merging it into the local passwd and group files
(respectively) on these hosts.
It's just a legacy feature, so those who need it can fall back to
But the LDAP provider doesn't support ID mapping; only the AD provider does. And ID
mapping is the main reason we use sssd.
I'm not asking you to make enumeration the default. It shouldn't be; it should be
something you only turn on if you need it, and you KNOW you need it. But if you need it,
you NEED it. Please don't take it away.
sssd-users mailing list
The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.