On (20/09/17 09:34), Sumit Bose wrote:
On Tue, Sep 19, 2017 at 04:08:34PM -0400, James Ralston wrote:
> I have a storage appliance that needs local passwd/group files loaded
> onto it, which need to match the entries we get by using sssd's
> ldap_id_mapping feature. So I need some way to enumerate or synthesize
> passwd/group entries, for every user/group object in our domain, using
> LDIF dumps from AD that includes all users/groups, along with their
> respective objectSid attributes.
>
> We know (from experience, and from discussion on this list) that
> enabling enumeration in sssd is problematic, so that's out.
>
> I could just issue individual getpwnam()/getgrnam() calls for every
> user/group object, and let sssd synthesize the entries. But this would
> require careful tuning of sssd's cache configuration options to avoid
> significant delays, and even then, this would pound our AD domain
> controllers with thousands and thousands of lookup requests every time
> we regenerate the synthesized passwd/group files (which will probably
> be hourly).
>
> From digging around in the sssd source code, I see that sssd has a
> SSS_NSS_GETIDBYSID API call that looks to be exactly what I need. But
> it's not clear to me whether that's a public or private API, and
> additionally, it looks like I'd be limited to C for my implementation,
> as I see no other language bindings for those functions.
>
> Has anyone already rolled (Python, Ruby, Perl, et. al.) bindings for
> sssd's API calls, specifically the ID-SID mapping calls?
$ python
Python 2.7.12 (default, Sep 29 2016, 12:52:15)
[GCC 6.2.1 20160916 (Red Hat 6.2.1-2)] on linux2
Type "help", "copyright", "credits" or "license"
for more information.
>>> import pysss_nss_idmap
>>>
pysss_nss_idmap.getidbysid('S-1-5-21-3692237560-1981608775-3610128199-1104')
{'S-1-5-21-3692237560-1981608775-3610128199-1104': {'type': 3,
'id': 1367201104}}
>>>
Please see 'pydoc pysss_nss_idmap' for details. On Fedora/RHEL the
bindings are in the python[23]-libsss_nss_idmap package.
+ more examples in integration test
https://github.com/SSSD/sssd/pull/373/files#diff-b580c91e5e70802720510b5b...
LS