[SSSD] Design Discussion: IPA Server Mode

Jakub Hrozek jhrozek at redhat.com
Wed May 29 15:17:37 UTC 2013


On Wed, May 29, 2013 at 12:51:43PM +0200, Sumit Bose wrote:
> > > The task should make sure all users and groups are read after a while
> > > without reading objects twice in a single run. Maybe it is possible to
> > > add a special paged-search tevent request which returns after the first
> > > page is read to the caller (instead of doing the paging behind the scenes)
> > > which the results and a handle which would allow to continue the the search
> > > with the next page? If this is a way to go creating this new request would
> > > be another development subtask.
> > > 
> > 
> > Yes, I was considering about similar design when I was thinking about #1829.
> > 
> > Maybe we could do the enumeration only for the trusted domains so that
> > it would run on the background only. Then we wouldn't have to worry
> 
> yes, I thought this task will only lookup trusted domain account. If you
> want enumeration for the IPA accounts, if can be switched on with the
> enumerate config option.
> 
> > about how to handle getpwent/getgrent requests towards the frontend.
> 
> I'm not sure what you mean here.

There is some special casing in the nss responder that is enabled when a
domain enumerates. I meant that if the enumeration was only on the
background and only for the trusted domains, the nss responder would act
like there was no enumeration at all and "getent passwd" calls could
just return empty like they do when there is no enumeration at all.



More information about the sssd-devel mailing list