[SSSD] DESIGN: Multiple LDAP search bases

Dmitri Pal dpal at redhat.com
Tue Sep 13 18:33:02 UTC 2011


On 09/13/2011 12:20 PM, Stephen Gallagher wrote:
> On Mon, 2011-09-12 at 08:41 -0400, Stephen Gallagher wrote:
>> I'm starting to implement the "multiple search bases" feature requested
>> in https://fedorahosted.org/sssd/ticket/868
>>
>> I want a bit of input on my design (Original text at
>> https://fedorahosted.org/sssd/wiki/DesignDocs/MultipleSearchBases
>>
>> I don't expect there to be any disagreements about the individual lookup
>> case, but I'm not sure if there will be contention around the
>> enumeration decisions. Recommendations are welcome.
> Something else occurred to me today. We have a feature that allows not
> specifying a search base and instead auto-detecting it from the LDAP
> server's RootDSE (using the namingContexts and defaultNamingContext
> attributes).
>
> In most cases, the namingContext is a single value which is not
> interesting. However, there are some deployments for which there are
> multiple namingContexts attributes. For these, our current approach is
> to check whether there already exists a defaultNamingContext attribute.
> If so, we use that instead.
>
> Now that we're adding multiple search bases, it's worth discussing
> whether - if we're auto-detecting the search base - we should be using
> ALL of the namingContexts.
>
> So I see two possible approaches:
>
> 1) We continue to behave as we do now, allowing only the
> defaultNamingContext (or if that's not available, only selecting a
> namingContext if there is exactly one). This is obviously the simplest
> answer. We can then instruct users to explicitly configure additional
> search bases.
>
> 2) We can use all of the namingContext values in the order they're
> returned from LDAP (making sure that defaultNamingContext is always the
> first in the list if it is available).
>
>
> I'm inclined to just implement 1) at this time and revisit this if
> customers complain.

+1 on 1)
Open a separate ticket for 2) and put into deferred for now.

>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110913/4129c872/attachment.html>


More information about the sssd-devel mailing list