[SSSD] Behaviour of getgrnam/getgrgid

Ralf Haferkamp rhafer at suse.de
Thu Sep 16 15:50:28 UTC 2010


Hi,

On Thursday 09 September 2010 15:14:10 Ralf Haferkamp wrote:
[..]
> 
> I have started working on a patch to let sssd look up the non-cached
> users via LDAP (and save them into the cache). Find it attached. Note:
> That patch is not really complete (e.g. it doesn't handle rfc2307
> groups correctly). But before putting more effort into this I like to
> make sure that I am not trying to fix a "feature" here.

Find a newer version of my patch attached. Actually it's 3 patches now. 
Please review.

Patch1: This just adds a new flag to save_groups() to indicate that the 
   group's member attribute is already populated with the members' sysdb 
   DN (instead on LDAP DNs). As I need to lookup the group members in
   sysdb anyway, when processing the group, this saves some redundant
   sysdb lookups when storing the group.

Patch2: This is a somewhat improved version of my last patch. 
   - better error handling
   - limit the number of LDAP requests that are issued before
     starting to process the results. This is especially needed when 
     dealing with large groups, otherwise the server might choke on us
     (e.g. OpenLDAP has a (configurable) limit of 100 pending operations 
     per anonymous connection and 1000 per authenticated connection).
     OTOH sending multiple LDAP request at once will speed up things a
     bit compared to just sending the next request after processing the
     result of the previous.
   - populate the "member" attribute with the correct sysdb DNs to 
     utilize Patch1.
   - limit the group unrolling to rfc2307bis for now. rfc2307 and IPA
     need to be treated differently as discussed previously in this 
     thread.

Patch3: This adds a new config option to "ldap_unroll_group_members" to
   enable/disable group unrolling


regards,
	Ralf

-- 
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Shortcut-for-save_group-to-accept-sysdb-DNs-as-membe.patch
Type: text/x-patch
Size: 3726 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100916/7f60143a/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Return-all-group-members-from-getgr-nam-gid.patch
Type: text/x-patch
Size: 15573 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100916/7f60143a/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-New-config-option-to-disable-group-unrolling.patch
Type: text/x-patch
Size: 2629 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100916/7f60143a/attachment-0002.bin>


More information about the sssd-devel mailing list