[SSSD] [PATCHES] Performance enhancements for AD provider

Stephen Gallagher sgallagh at redhat.com
Thu Sep 20 13:34:37 UTC 2012


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

* [PATCH 1/2] AD: Detect domain controller compatibility version
This patch allows us to read the domain controller version from the
RootDSE, if it exists. This will be used by the next patch to
determine if the SSSD can use tokenGroups for lookups.

* [PATCH 2/2] AD: Optimize initgroups lookups with tokenGroups
If we are doing ID-mapped lookups, we can take advantage of the
AD-specific option "tokenGroups", which allows us to retrieve a
pre-flattened list of all the group SIDs for which this user is a
member. From this, we can convert them to GIDs and conclude the
initgroups() lookup with only two LDAP queries (the search for the
user and the base search for the user's tokengroups; the latter must
be performed as a base search due to restrictions imposed on the
tokenGroups attribute by AD).

When we save these groups to the sysdb, if the group is being seen for
the first time it will be temporarily given the name of the SID
representing it. Later, when we look it up by name or GID, this group
will be replaced with the real one.

Fixes https://fedorahosted.org/sssd/ticket/1355
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iEYEARECAAYFAlBbG2wACgkQeiVVYja6o6M9CQCdFwXQ2yBIlo7wPtJ4PAXW8Lt1
VLwAoINgdsNnq/2Z4Sl2KlQe68e3FXmJ
=uyEO
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-AD-Detect-domain-controller-compatibility-version.patch
Type: text/x-patch
Size: 4200 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120920/81b2d395/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-AD-Optimize-initgroups-lookups-with-tokenGroups.patch
Type: text/x-patch
Size: 12938 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120920/81b2d395/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-AD-Detect-domain-controller-compatibility-version.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120920/81b2d395/attachment.sig>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-AD-Optimize-initgroups-lookups-with-tokenGroups.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120920/81b2d395/attachment-0001.sig>


More information about the sssd-devel mailing list