[SSSD] [PATCHES][PRELIMINARY] Add support for AD's chain matching filter

Jan Zelený jzeleny at redhat.com
Tue Jun 12 08:50:25 UTC 2012


> On Mon, 2012-06-11 at 21:19 -0400, Stephen Gallagher wrote:
> > New patches attached, along with the results of my (limited)
> > performance
> > testing.
> > 
> > These patches split the option into two, so it can be enabled for
> > initgroups or group lookups separately. The testing I did on group
> > lookups seems to suggest that it's a distinct performance hit.
> 
> I'm wondering if we shouldn't try at least the initgroups by default.
> What's the error for servers that do not recognize the syntax ?
> Can we 'probe' the syntax at connection time (like we check for the
> rootdse) and set a flag about whether it work or not ?
> 
> That way we can set at least ldap_initgroups_use_matching_rule_in_chain
> = auto or similar by default and have the benefit any time the option is
> available w/o forcing the admins to find out.
> It would be a pretty obscure toggle anyway, very few would take benefit
> if we do not find a way to auto-discover it.
> 
> Simo.

The auto-discovery is possible to some degree but a bit ugly. You can do 
following search [1]:

base: CN=<domain_name>,OU=Domain Controllers,<suffix>
scope: base
attributes: operatingSystemVersion, operatingSystemServicePack

And then use following condition to detect if server supports the feature (the 
code is not accurate, it only demonstrates the idea. Some processing of both 
attributes would be necessary beforehand):

if ((operatingSystemVersion == 3790 &&
     operatingSystemServicePack >= 2) || 
     operatingSystemVersion > 3790)
         return true;
else
         return false;

Of course the code only detects if the AD server supports chaining. If there 
is possibilty to turn it off somehow, I don't know how to detect it. I checked 
both supportedControl and supportedCapabilities attributes in rootDSE of 
Stephen's testing AD server, there is no mention about this one.


Thanks
Jan

[1] http://www.netusil.cz/phprs/view.php?cisloclanku=2009040007
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120612/231912de/attachment.sig>


More information about the sssd-devel mailing list