[SSSD] Design Discussion: IPA Server Mode

Sumit Bose sbose at redhat.com
Wed May 29 15:44:08 UTC 2013


On Wed, May 29, 2013 at 05:17:37PM +0200, Jakub Hrozek wrote:
> On Wed, May 29, 2013 at 12:51:43PM +0200, Sumit Bose wrote:
> > > > The task should make sure all users and groups are read after a while
> > > > without reading objects twice in a single run. Maybe it is possible to
> > > > add a special paged-search tevent request which returns after the first
> > > > page is read to the caller (instead of doing the paging behind the scenes)
> > > > which the results and a handle which would allow to continue the the search
> > > > with the next page? If this is a way to go creating this new request would
> > > > be another development subtask.
> > > > 
> > > 
> > > Yes, I was considering about similar design when I was thinking about #1829.
> > > 
> > > Maybe we could do the enumeration only for the trusted domains so that
> > > it would run on the background only. Then we wouldn't have to worry
> > 
> > yes, I thought this task will only lookup trusted domain account. If you
> > want enumeration for the IPA accounts, if can be switched on with the
> > enumerate config option.
> > 
> > > about how to handle getpwent/getgrent requests towards the frontend.
> > 
> > I'm not sure what you mean here.
> 
> There is some special casing in the nss responder that is enabled when a
> domain enumerates. I meant that if the enumeration was only on the
> background and only for the trusted domains, the nss responder would act
> like there was no enumeration at all and "getent passwd" calls could
> just return empty like they do when there is no enumeration at all.

ah, I see. Yes, the nss responder is not involved in this enumeration.

bye,
Sumit
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list