[SSSD] [PATCHES][PRELIMINARY] Add support for AD's chain matching filter
Jan Zelený
jzeleny at redhat.com
Tue Jun 12 08:50:25 UTC 2012
> On Mon, 2012-06-11 at 21:19 -0400, Stephen Gallagher wrote:
> > New patches attached, along with the results of my (limited)
> > performance
> > testing.
> >
> > These patches split the option into two, so it can be enabled for
> > initgroups or group lookups separately. The testing I did on group
> > lookups seems to suggest that it's a distinct performance hit.
>
> I'm wondering if we shouldn't try at least the initgroups by default.
> What's the error for servers that do not recognize the syntax ?
> Can we 'probe' the syntax at connection time (like we check for the
> rootdse) and set a flag about whether it work or not ?
>
> That way we can set at least ldap_initgroups_use_matching_rule_in_chain
> = auto or similar by default and have the benefit any time the option is
> available w/o forcing the admins to find out.
> It would be a pretty obscure toggle anyway, very few would take benefit
> if we do not find a way to auto-discover it.
>
> Simo.
The auto-discovery is possible to some degree but a bit ugly. You can do
following search [1]:
base: CN=<domain_name>,OU=Domain Controllers,<suffix>
scope: base
attributes: operatingSystemVersion, operatingSystemServicePack
And then use following condition to detect if server supports the feature (the
code is not accurate, it only demonstrates the idea. Some processing of both
attributes would be necessary beforehand):
if ((operatingSystemVersion == 3790 &&
operatingSystemServicePack >= 2) ||
operatingSystemVersion > 3790)
return true;
else
return false;
Of course the code only detects if the AD server supports chaining. If there
is possibilty to turn it off somehow, I don't know how to detect it. I checked
both supportedControl and supportedCapabilities attributes in rootDSE of
Stephen's testing AD server, there is no mention about this one.
Thanks
Jan
[1] http://www.netusil.cz/phprs/view.php?cisloclanku=2009040007
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120612/231912de/attachment.sig>
More information about the sssd-devel
mailing list