[SSSD] SIGSEGV in sssd_be using ldap_init_fd

Stephen Gallagher sgallagh at redhat.com
Fri Jul 29 12:39:20 UTC 2011


On Fri, 2011-07-29 at 14:09 +0200, Jan Zelený wrote:
> > Jan Zelený wrote:
> > > Yes, in recent versions you should have something like
> > > 
> > > libnss3.so()(64bit)
> > 
> > Just to confirm, this all now works perfectly and either GSSAPI or TLS.
> > Am I right in assuming they are mutually exclusive?
> 
> Yes, they should be. However I'm not entirely sure if they are made mutually 
> exclusive in the code. We shall verify this.

I think we don't stop you from setting ldap_id_use_start_tls, but it's
only going to introduce unnecessary slowdown (encrypting everything
twice).

> 
> > I'm switching to sssd to bind to an AD domain with >100k user objects
> > and nearly 200k groups.  sssd seems to be making a really good stab at
> > coping with that, in a way that an unmodified nss_ldap/nscd simply
> > couldn't.  To be honest, that's pretty remarkable.
> 
> Thanks, we're always happy to hear that.

John, you should be aware of https://fedorahosted.org/sssd/ticket/783
though. Currently we don't support AD's standards-violating RANGE
extension, so we're limited to the first 1500 (AD 2008) or 1000 (AD
2003) users listed in a group.

So if you have any exceedingly large groups, you're likely to hit this.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110729/e085bc42/attachment.sig>


More information about the sssd-devel mailing list