[SSSD] [PATCHES][PRELIMINARY] Add support for AD's chain matching filter
Simo Sorce
simo at redhat.com
Tue Jun 12 12:25:12 UTC 2012
On Tue, 2012-06-12 at 10:50 +0200, Jan Zelený wrote:
> > On Mon, 2012-06-11 at 21:19 -0400, Stephen Gallagher wrote:
> > > New patches attached, along with the results of my (limited)
> > > performance
> > > testing.
> > >
> > > These patches split the option into two, so it can be enabled for
> > > initgroups or group lookups separately. The testing I did on group
> > > lookups seems to suggest that it's a distinct performance hit.
> >
> > I'm wondering if we shouldn't try at least the initgroups by default.
> > What's the error for servers that do not recognize the syntax ?
> > Can we 'probe' the syntax at connection time (like we check for the
> > rootdse) and set a flag about whether it work or not ?
> >
> > That way we can set at least ldap_initgroups_use_matching_rule_in_chain
> > = auto or similar by default and have the benefit any time the option is
> > available w/o forcing the admins to find out.
> > It would be a pretty obscure toggle anyway, very few would take benefit
> > if we do not find a way to auto-discover it.
> >
> > Simo.
>
> The auto-discovery is possible to some degree but a bit ugly. You can do
> following search [1]:
>
> base: CN=<domain_name>,OU=Domain Controllers,<suffix>
> scope: base
> attributes: operatingSystemVersion, operatingSystemServicePack
>
> And then use following condition to detect if server supports the feature (the
> code is not accurate, it only demonstrates the idea. Some processing of both
> attributes would be necessary beforehand):
>
> if ((operatingSystemVersion == 3790 &&
> operatingSystemServicePack >= 2) ||
> operatingSystemVersion > 3790)
> return true;
> else
> return false;
This would probably fail with samba that fakes up the version reported.
No I was talking about actually probing the functionality.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list