We had this discussion before:
https://lists.fedorahosted.org/pipermail/sssd-users/2014-May/001630.html
With lots of fine-grained ACLs in the LDAP server (like in my setup) each
additional assertion attribute type is a performance penalty (without
additional benefit in my setup).
Same here. It's probably worthwhile to note that my use of fine grained ACL's is
far more intense than I'd prefer because sssd has no mechanism to define cross-domain
groups. More precisely, it doesn't have a vocabulary for pointing at a local ldap
server which defines groups composed from multiple domains.
I've thought to point sssd at my "merged domain", but I'd lose the
ability to do Kerberos authentication (need per-domain spec of Kerberos info). The choice
appears to be cross-domain groups, or Kerberos (and NFSv4), but not both.
Bryce
This electronic message contains information generated by the USDA solely for the intended
recipients. Any unauthorized interception of this message or the use or disclosure of the
information it contains may violate the law and subject the violator to civil or criminal
penalties. If you believe you have received this message in error, please notify the
sender and delete the email immediately.