[SSSD] DESIGN: Multiple LDAP search bases

Simo Sorce simo at redhat.com
Tue Sep 13 19:42:20 UTC 2011


On Tue, 2011-09-13 at 12:20 -0400, Stephen Gallagher wrote:
> On Mon, 2011-09-12 at 08:41 -0400, Stephen Gallagher wrote:
> > I'm starting to implement the "multiple search bases" feature requested
> > in https://fedorahosted.org/sssd/ticket/868
> > 
> > I want a bit of input on my design (Original text at
> > https://fedorahosted.org/sssd/wiki/DesignDocs/MultipleSearchBases
> > 
> > I don't expect there to be any disagreements about the individual lookup
> > case, but I'm not sure if there will be contention around the
> > enumeration decisions. Recommendations are welcome.
> 
> Something else occurred to me today. We have a feature that allows not
> specifying a search base and instead auto-detecting it from the LDAP
> server's RootDSE (using the namingContexts and defaultNamingContext
> attributes).
> 
> In most cases, the namingContext is a single value which is not
> interesting. However, there are some deployments for which there are
> multiple namingContexts attributes. For these, our current approach is
> to check whether there already exists a defaultNamingContext attribute.
> If so, we use that instead.
> 
> Now that we're adding multiple search bases, it's worth discussing
> whether - if we're auto-detecting the search base - we should be using
> ALL of the namingContexts.
> 
> So I see two possible approaches:
> 
> 1) We continue to behave as we do now, allowing only the
> defaultNamingContext (or if that's not available, only selecting a
> namingContext if there is exactly one). This is obviously the simplest
> answer. We can then instruct users to explicitly configure additional
> search bases.
> 
> 2) We can use all of the namingContext values in the order they're
> returned from LDAP (making sure that defaultNamingContext is always the
> first in the list if it is available).
> 
> 
> I'm inclined to just implement 1) at this time and revisit this if
> customers complain.

Number 2) would be often wrong, as those separate naming contexts are
used for unrelated stuff (see AD for a bright example).
So even if we implemented (2) we'd have to disable it by default.

I'd go with just (1).

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list