[SSSD] [PATCH] Per-domain re_expression and full_name_format

Jakub Hrozek jhrozek at redhat.com
Tue Apr 24 09:43:35 UTC 2012


On Tue, Apr 24, 2012 at 08:36:32AM +0200, Stef Walter wrote:
> On 04/23/2012 09:00 PM, Simo Sorce wrote:
> > Doesn't this end up running potentially the same regex over and over for
> > each domain we have configured ?
> > Wouldn't it make sense to detect how many different regexes we actually
> > have (in the default case just one, the same for all domains) and just
> > run them once ? Then we can sort out which of the domains using that
> > regex is being addressed ...
> > or is there something I am missing ?
> 
> Yes that could be a nice optimization ... if we are in fact matching
> more than a handful of regexes (ie: configured domains).
> 
> But that brings to mind another related point. How are other 'trusted'
> domains in the forest handled, and does this patch break them? Is there
> somewhere in SSSD that handles arbitrary domain names, and figures out
> which configured domain they go to. How does that work?
> 
> For example let's say I have a domain 'ad.thewalter.lan' configured in
> sssd which is part of a trust relationship with 'other.thewalter.lan'.
> 'other.thewalter.lan' is not a configured sssd domain. How do we resolve
> user names for other.thewalter.lan?
> 
> If this is correctly handled, then I guess I missed consideration of
> this in my patch. Pointers to the where this logic lives in sssd would
> be nice.
> 

Hi Stef,
the trusted domain appear as subdomains in SSSD. The subdomains support
is currently on the list on review:
https://fedorahosted.org/pipermail/sssd-devel/2012-March/009069.html

The design document is here:
https://fedorahosted.org/sssd/wiki/DesignDocs/SubDomains

I think that patch #4 in the patch set shows what you need - there is a
"struct sss_domain_info **subdomains;" array that lists the sub domains
the main domain trusts.



More information about the sssd-devel mailing list