[SSSD] Missing word? User Private Group and User Magic Group

Dmitri Pal dpal at redhat.com
Fri Nov 6 02:11:18 UTC 2009


David O'Brien wrote:
> The following is taken from "The LOCAL Provider" section on the 
> HOWTO_Configure page on the wiki:
>
> "Using Magic Private groups bring the benefit of better Windows 
> Interoperability (in Windows, the ID and name spaces are unique) and 
> also avoids creating a group for every user, thus cluttering the group 
> space. Also, for NSS calls, every user is actually returned as user's 
> private group without having to explicitly create the group, thus having 
> the same effect as User Private Groups "
>
> The 2nd sentence doesn't quite add up.
>
> thanks
>   
davido, ping
<dpal> davido, MPG, I will try to explain
<dpal> davido, user private group is a group that only has one user.
<dpal> davido, in UNIX world there is a private group for each user, so
there are more group records than user records in total.
<dpal> davido, creating and maintaining all these groups for each user
centrally and delivering them to each machine is a big cost
<dpal> so the idea is to dynamically create user's private group on the
fly for each user and return its ID.
<dpal> How it can be?
<dpal> If you have a flat namespace between user entries and group
entries you can be sure that the there never be a group with the same id
as some of the users
<dpal> Based on this assumption you can on the fly generate private
group with the same ID as user ID and with the same name without worry
that there will be any collision.
<dpal> So this is what the second sentence tries to say.
<dpal> For NSS calls (read identity calls) the SSSD will return
(dynamically created on the fly) user private group without actually
creating a special User Private Group record.
<dpal> davido, makes sense?

-- 
Thank you,
Dmitri Pal

Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/




More information about the sssd-devel mailing list