[SSSD] [PATCHES][PRELIMINARY] Add support for AD's chain matching filter

Simo Sorce simo at redhat.com
Tue Jun 12 01:59:21 UTC 2012


On Mon, 2012-06-11 at 21:19 -0400, Stephen Gallagher wrote:
> New patches attached, along with the results of my (limited)
> performance
> testing.
> 
> These patches split the option into two, so it can be enabled for
> initgroups or group lookups separately. The testing I did on group
> lookups seems to suggest that it's a distinct performance hit.
> 
I'm wondering if we shouldn't try at least the initgroups by default.
What's the error for servers that do not recognize the syntax ?
Can we 'probe' the syntax at connection time (like we check for the
rootdse) and set a flag about whether it work or not ?

That way we can set at least ldap_initgroups_use_matching_rule_in_chain
= auto or similar by default and have the benefit any time the option is
available w/o forcing the admins to find out.
It would be a pretty obscure toggle anyway, very few would take benefit
if we do not find a way to auto-discover it.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list