[SSSD] Recommended settings.

Patrik Martinsson Patrik.Martinsson at smhi.se
Fri Aug 6 10:00:15 UTC 2010


Ah ok, cool i hear you.

I reccon we need to have the enumeration option, it's really handy to 
lookup users that way, we have done it for so along time (And god forbid 
to change things, right ;)).
I found the option enum_cache_timeout, which defaults to 120 seconds, 
which means if i understand it right that it will refresh the enum_cache 
(thus enumrate the ad) every
120 seconds, which seems to be overkill in my opinion.

Hmm, this is a bit tricky to have it the way i want i guess,
#1, I want sssd to cache user info to be able to login offline.
#2, Although when I do a getent passwd I would like a fresh list from 
the AD, (like nss/ldap did it)
#3, However when a user login I do not want to wait for sssd to 
enumarate the AD (taking alot of time)

I'm thinking of following setup/scenario.
#1, I set enum_cache option to 999999 or whatever so sssd only 
enumerates at start, because it does that right ? Then i would have a 
fresh sssd cache at start.
#2, Then some user gets added to the AD.
#3, I try to find that user, getent passwd | grep email (couse i just 
know his name, not the username) and i wont find that user, since 
sssd-cache thats being returned doesnt contain that user.

I guess i need to figure out some other way of working maybe.

/Patrik



On 08/06/2010 11:30 AM, Jakub Hrozek wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 08/06/2010 11:18 AM, Patrik Martinsson wrote:
>    
>> So basically, what I'm wondering is, cant i have getent passwd returning
>> all my users without having enumerate = true in the config ?
>>      
> No, if you run "getent passwd" (without any specific user) you are doing
> an enumeration and for that to work, you need to have the "enumerate"
> parameter set to "true". As a side note, if you'd like to enumerate only
> users served via SSSD, you can run "getent passwd -s sss" (asking only
> for users from the nss_sss module).
>
> Enumeration is not advised in large directories, but please note that
> only the first enumeration would be slow as SSSD needs to pull the users
> from the server. After that, if would return the entries from cache.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkxb1j8ACgkQHsardTLnvCXpQQCePCJSITrhp8oXVDIAxKU/O/nd
> jl8Ani1WSjSzborNyk30Yx2uN6uQGKBE
> =BfCS
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
>    



More information about the sssd-devel mailing list