Hi,
On Fri, Jan 19, 2024 at 10:03 AM Finn Fysj <finnfysj133(a)gmail.com> wrote:
> with LDAP, recursively searching for all nested subgroups, sub-sub-groups,
> etc. -- that can be an expensive operation.
>
> the default ldap_group_nesting_level is 2. You might try to set that to
> some larger number (like 5 or 6) to see if it makes any difference.
So... We divide users into different teams (groups): e.g sysadmins, testers, etc. and
then give these groups membership to other groups rather than the user directly. So,
according to my understanding a nesting level of 2 should be enough?
However, when I run getent group testers, I don't get any results unless I give a
specific user membership to that group.
What I want:
IPA:
group: sysadmins
member: user1
member: user2
member: user3
group: prod
member: sysadmins
getent group prod
prod:<GID>: user1,user2,user3
> If you're connecting to AD, there's an optimization that's not
expensive
> (to clients doing LDAP searches) called 'tokengroups'.
IPA is being used as out LDAP server.
IPA doesn't show member attribute for non-authenticated binds
Typically users are interested in the correct group list the user is a
member of.
On the other side, 'ignore_group_members = true' is used often for
performance reasons.
Why do you care about 'getent group' and why don't you use
"id_provider=ipa"?