[SSSD] [RFC] Change default regular-expressions for user names

Jakub Hrozek jhrozek at redhat.com
Thu May 22 13:58:42 UTC 2014


On Thu, May 22, 2014 at 09:42:15AM -0400, Simo Sorce wrote:
> > > Is it possible to have a user foo in domain example.com that has a
> > > principal of bar at EXAMPLE.COM ? And at the same time also have a user
> > > 'bar' in the same domain ?
> > > Is this the case you are trying to handle ? How likely is it ?
> > 
> > no, I think this is quite unlikely. My concern was more related to
> > performance. If we decide that name at REALM is a principal because we
> > didn't find user 'name' in domain 'REALM' we have to iterate over all
> > configured domains and check if there is a user with the given
> > principal. If the domain is known for the principal we cannot only skip
> > the user lookup but can search the given domain directly. The krb5
> > localauth will be able to give the right domain in all the cases where
> > the user logs in with a fully qualified name or if fully qualified names
> > are used as canonical names.
> 
> If we index the principal names, a perfect match search will be quite
> fast, I do not think performance will be a big deal.

I think the performance hit comes even earlier. If you need to check if
name at REALM is a user name in a domain REALM, you need to start N
searches for N configured domains and only then you will start searching
by the principals.



More information about the sssd-devel mailing list