[SSSD] getent returns only single users

Jakub Hrozek jhrozek at redhat.com
Mon Apr 15 09:33:09 UTC 2013


On Mon, Apr 15, 2013 at 11:22:22AM +0200, steve wrote:
> On 15/04/13 10:13, John Hodrien wrote:
> >On Mon, 15 Apr 2013, steve wrote:
> >
> >>On 04/15/2013 08:26 AM, John Hodrien wrote:
> >>>Enumerate = false
> >>>
> >>>Jh
> >>Hi
> >>We have that. Are you saying it's case sensitive? Just tested it
> >>but it doesn't seem to be.
> >>
> >>Question: are we supposed to be able to get a list of all users
> >>in ldap using getent passwd?
> >
> >Sorry, I was posting in a hurry before I went out.  This is my reading of
> >things.
> >
> >You're disabling enumerate, and then finding out you can't enumerate all
> >users.  Surely this shouldn't be a surprise?  I'd also question
> >why you even
> >want to be able to do that.  What's your reason for wanting to be
> >able to list
> >*all* users?
> >
> >jh
> Hi
> I t was that enumerate = true wasn't working either. I've just added
> the Ubuntu update ppa:
> https://launchpad.net/~*sssd*/+archive/updates
> The version that comes with 12.10 seems totally broken. This one
> works as I expect: getent passwd returns a list of both local and
> domain users, but it's not workable. Even with only 3 boxes
> connected, the server just grinds to a halt. The ldap queries never
> stop. With nslcd, it's just one quick read for the whole lot and the
> next time you ask, it doesn't read anything at all from the
> directory. i wonder what sssd is doing with all those reads?
> 

Have you been able to check what kind of searches (with wireshark or similar
or even just looking at the debug logs) sssd is doing? There should be
one search for users and one for groups every 300 seconds by default
(can be overriden with ldap_enumeration_refresh_timeout).

Also how many users/groups do you have on the server?

> We use getent passwd in many of our scripts which are mostly
> wrappers around samba-tool which ships with the Samba 4.0 AD. It's
> nothing that we couldn't do with wbinfo instead of getent, but I
> would prefer to leave the scripts as they are and stick with nslcd.
> We like sssd because it's got everything in one place.
> 
> Anyway, we've not given up yet. Maybe the method used for
> enumeration on sssd will change to something more like nslcd or
> winbind in future.
> Steve

Well, one reason for the enumeration being slower in sssd is that sssd
(unlike nscd at least) stores all the entries it downloaded from LDAP to
a persistent on-disk cache. That cache write can take up to a couple of
seconds, depending on the size of the directory.



More information about the sssd-devel mailing list