[SSSD] [DESIGN] Allow Kerberos Principals in getpwnam() calls

Sumit Bose sbose at redhat.com
Mon Jun 2 09:24:41 UTC 2014


On Mon, Jun 02, 2014 at 10:10:20AM +0200, Jakub Hrozek wrote:
> On Fri, May 30, 2014 at 06:09:13PM +0200, Sumit Bose wrote:
> > Hi,
> > 
> > I have summarized a thread on this list and added some additional
> > information on
> > https://fedorahosted.org/sssd/wiki/DesignDocs/NSSWithKerberosPrincipal
> > 
> > For your convenience the text can be found below as well. Comments and
> > suggestions are welcome.
> > 
> > bye,
> > Sumit
> 
> Very nice design page!
> 
> I fixed some typos while I was going through the text.
> 
> One question about the cache lookups -- do you plan on looking up the
> user names in all domains first and then principals:
> 
>     for dom in domain:
>         getpwnam(input)
>     if not match:
>         for dom in domain:
>             get_user_by_princ(input)
> 
> or look up name and principal before moving on to the next domain?
> 
>     for dom in domain:
>         getpwnam(input)
>         if not match:
>             get_user_by_princ(input)

Currently my idea was the first one to not change the existing behaviour
too much.

But if we start to optimize the NSS responder at some point to search
the cache for all domains first and only reach out to the backend if
nothing was found in chache for any domain, we might want to fold the
principal lookup in the cache lookups.

bye,
Sumit

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list