[SSSD] Ticket #1376 -- Add support for suppressing group members

Paul B. Henson henson at acm.org
Wed Nov 14 06:24:15 UTC 2012


On Nov 13, 2012, at 9:06 PM, Simo Sorce <simo at redhat.com> wrote:

> Well my concern is allowing people to get the perf. benefit you need, as
> you may not be the only one who needs it, w/o causing issues for those
> apps that will use getgrnam() or getgrgid() to check stuff.

If you have a reliance on an app using getgr lookups, you probably shouldn't enable an option called "ignore_group_members" ;). The trade off you're making for that increased performance is that you're not going to get group members via that interface. 

I just don't see a mechanism that returns a subset of members depending on who's happened to log in recently as desirable. From a sysadmin perspective, I'd rather it reproducibly returns no members than return a potentially different subset on each call. "Hmm, the app seems to work right after bob logs in but then stops working a few hours later"...





More information about the sssd-devel mailing list