[SSSD] [PATCH] Adding option to disable retrieving large AD groups.

Lukas Slebodnik lslebodn at redhat.com
Mon May 13 15:08:44 UTC 2013


ehlo,

Jakub, Pavel and me disscus about ticket
https://fedorahosted.org/sssd/ticket/1823
"getgrnam / getgrgid for large user groups is too slow due to range retrieval
functionality"
We decided to add new option to turn the range retrieval with AD. Another
solution could be to add new option to limit the number of group members
processed.

Any comments are welcomed.

This commit adds new option ldap_disable_large_groups with default value FALSE.
If this option is enabled, large groups(>1500) will not be retrieved and
behaviour will be similar like was before commit ae8d047122c
"LDAP: Handle very large Active Directory groups"

LS
-------------- next part --------------
>From 0ad1ef13b2f02203021bb5fafd7c61ede37cac9d Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Mon, 13 May 2013 12:40:39 +0200
Subject: [PATCH] Adding option to disable retrieving large AD groups.

This commit adds new option ldap_disable_large_groups with default value FALSE.
If this option is enabled, large groups(>1500) will not be retrieved and
behaviour will be similar like was before commit ae8d047122c
"LDAP: Handle very large Active Directory groups"

https://fedorahosted.org/sssd/ticket/1823
---
 src/config/SSSDConfig/__init__.py.in     |  1 +
 src/config/etc/sssd.api.d/sssd-ldap.conf |  1 +
 src/man/sssd-ldap.5.xml                  | 19 +++++++++++++++++++
 src/providers/ad/ad_opts.h               |  1 +
 src/providers/ipa/ipa_opts.h             |  1 +
 src/providers/ldap/ldap_opts.h           |  1 +
 src/providers/ldap/sdap.c                | 11 ++++++++---
 src/providers/ldap/sdap.h                |  4 +++-
 src/providers/ldap/sdap_async.c          |  7 +++++--
 9 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index bc7bb0a781a64b264d350a7766cf45de869273cf..4f17e791b4d856bf7d386c06142f90f7273ad33c 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -221,6 +221,7 @@ option_strings = {
     'ldap_connection_expiration_timeout' : _('How long to retain a connection to the LDAP server before disconnecting'),
 
     'ldap_disable_paging' : _('Disable the LDAP paging control'),
+    'ldap_disable_large_groups' : _('Disable large Active Directory groups'),
 
     # [provider/ldap/id]
     'ldap_search_timeout' : _('Length of time to wait for a search request'),
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index 40e2aa09d0b4e94976bc18f04f9ca2d0006d444e..fd19341c1aeb261d0f26d37cc24b3054690da359 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -35,6 +35,7 @@ ldap_sasl_canonicalize = bool, None, false
 ldap_sasl_minssf = int, None, false
 ldap_connection_expire_timeout = int, None, false
 ldap_disable_paging = bool, None, false
+ldap_disable_large_groups = bool, None, false
 
 [provider/ldap/id]
 ldap_search_timeout = int, None, false
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 799213300857f182b092287741a40665a0ae62d5..bd49b2a98466446ed098e71b724ab453dca0c69a 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1201,6 +1201,25 @@
                 </varlistentry>
 
                 <varlistentry>
+                    <term>ldap_disable_large_groups (boolean)</term>
+                    <listitem>
+                        <para>
+                            Disable very large Active Directory groups.
+                        </para>
+                        <para>
+                            This option has effect only, if LDAP server is
+                            Active Directory. Active Directory 2008R2 allows
+                            only 1500 group members to be retrieved in single
+                            lookup. Therefore if this option is enabled,
+                            members of group members will not be retrieved.
+                        </para>
+                        <para>
+                            Default: False
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
                     <term>ldap_sasl_minssf (integer)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index 32bbe3db2f4048056c7e96619eaf53ce22bf52f8..87cad7d5a8dc45ba86cd0865bc17d27b93407aae 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -122,6 +122,7 @@ struct dp_option ad_def_ldap_opts[] = {
     { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_rfc2307_fallback_to_local_users", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+    { "ldap_disable_large_groups", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index de9592b85c50ced32b7ab1c19c5f59eef89d6354..36ad741a9f5036396cd4f5578e83959b7000ac62 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -146,6 +146,7 @@ struct dp_option ipa_def_ldap_opts[] = {
     { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_rfc2307_fallback_to_local_users", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+    { "ldap_disable_large_groups", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h
index 2ed89f977839e4a7e3ea2c51f04e8db76a883fd9..db7be5e5a8a76c006d9ae86ee10cf011db499314 100644
--- a/src/providers/ldap/ldap_opts.h
+++ b/src/providers/ldap/ldap_opts.h
@@ -113,6 +113,7 @@ struct dp_option default_basic_opts[] = {
     { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_rfc2307_fallback_to_local_users", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+    { "ldap_disable_large_groups", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index 288d2d594a1401e9dbcc40b92cb68e946322791e..e84d1d90aab18bb03b1cd58fc8628af8c53a5155 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -95,7 +95,8 @@ int sdap_get_map(TALLOC_CTX *memctx,
 int sdap_parse_entry(TALLOC_CTX *memctx,
                      struct sdap_handle *sh, struct sdap_msg *sm,
                      struct sdap_attr_map *map, int attrs_num,
-                     struct sysdb_attrs **_attrs, char **_dn)
+                     struct sysdb_attrs **_attrs, char **_dn,
+                     bool disable_large_groups)
 {
     struct sysdb_attrs *attrs;
     BerElement *ber = NULL;
@@ -230,6 +231,10 @@ int sdap_parse_entry(TALLOC_CTX *memctx,
             store = true;
         }
 
+        if (disable_large_groups && strstr(str, ";range=") != NULL) {
+            store = false;
+        }
+
         if (store) {
             vals = ldap_get_values_len(sh->ldap, sm->msg, str);
             if (!vals) {
@@ -311,7 +316,7 @@ int sdap_parse_user(TALLOC_CTX *memctx, struct sdap_options *opts,
 {
 
     return sdap_parse_entry(memctx, sh, sm, opts->user_map,
-                            SDAP_OPTS_USER, _attrs, _dn);
+                            SDAP_OPTS_USER, _attrs, _dn, false);
 }
 
 /* This function converts an ldap message into a sysdb_attrs structure.
@@ -325,7 +330,7 @@ int sdap_parse_group(TALLOC_CTX *memctx, struct sdap_options *opts,
 {
 
     return sdap_parse_entry(memctx, sh, sm, opts->group_map,
-                            SDAP_OPTS_GROUP, _attrs, _dn);
+                            SDAP_OPTS_GROUP, _attrs, _dn, false);
 }
 
 /* Parses an LDAPDerefRes into sdap_deref_attrs structure */
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 8dbf38496553f3df6a320c8f57950745c25c6041..c46f960bd50c6b05d5d6705750e85ee7efaab59b 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -217,6 +217,7 @@ enum sdap_basic_opt {
     SDAP_AD_MATCHING_RULE_GROUPS,
     SDAP_AD_MATCHING_RULE_INITGROUPS,
     SDAP_RFC2307_FALLBACK_TO_LOCAL_USERS,
+    SDAP_DISABLE_LARGE_GROUPS,
 
     SDAP_OPTS_BASIC /* opts counter */
 };
@@ -433,7 +434,8 @@ int sdap_get_map(TALLOC_CTX *memctx,
 int sdap_parse_entry(TALLOC_CTX *memctx,
                      struct sdap_handle *sh, struct sdap_msg *sm,
                      struct sdap_attr_map *map, int attrs_num,
-                     struct sysdb_attrs **_attrs, char **_dn);
+                     struct sysdb_attrs **_attrs, char **_dn,
+                     bool disable_large_groups);
 
 int sdap_parse_user(TALLOC_CTX *memctx, struct sdap_options *opts,
                     struct sdap_handle *sh, struct sdap_msg *sm,
diff --git a/src/providers/ldap/sdap_async.c b/src/providers/ldap/sdap_async.c
index afa2904f478757fc15b5a54a411656bc7caa0bf0..d868656e1db36b8c1febb05e420f766bd4d32cec 100644
--- a/src/providers/ldap/sdap_async.c
+++ b/src/providers/ldap/sdap_async.c
@@ -1469,6 +1469,7 @@ struct sdap_get_generic_state {
     int map_num_attrs;
 
     struct sdap_reply sreply;
+    bool disable_large_groups;
 };
 
 static void sdap_get_generic_done(struct tevent_req *subreq);
@@ -1498,6 +1499,8 @@ struct tevent_req *sdap_get_generic_send(TALLOC_CTX *memctx,
 
     state->map = map;
     state->map_num_attrs = map_num_attrs;
+    state->disable_large_groups = dp_opt_get_bool(opts->basic,
+                                                  SDAP_DISABLE_LARGE_GROUPS);
 
     subreq = sdap_get_generic_ext_send(state, ev, opts, sh, search_base,
                                        scope, filter, attrs, false, NULL,
@@ -1523,7 +1526,7 @@ static errno_t sdap_get_generic_parse_entry(struct sdap_handle *sh,
 
     ret = sdap_parse_entry(state, sh, msg,
                            state->map, state->map_num_attrs,
-                           &attrs, NULL);
+                           &attrs, NULL, state->disable_large_groups);
     if (ret != EOK) {
         DEBUG(3, ("sdap_parse_entry failed [%d]: %s\n", ret, strerror(ret)));
         return ret;
@@ -1986,7 +1989,7 @@ static errno_t sdap_asq_search_parse_entry(struct sdap_handle *sh,
 
         ret = sdap_parse_entry(res[mi], sh, msg,
                                map, num_attrs,
-                               &res[mi]->attrs, NULL);
+                               &res[mi]->attrs, NULL, false);
         if (ret != EOK) {
             DEBUG(3, ("sdap_parse_entry failed [%d]: %s\n", ret, strerror(ret)));
             goto done;
-- 
1.8.1.4



More information about the sssd-devel mailing list