[SSSD] [PATCH] LDAP: Disable token groups by default

Lukas Slebodnik lslebodn at redhat.com
Tue Nov 11 12:26:05 UTC 2014


On (07/11/14 20:02), Michal Židek wrote:
>On 11/07/2014 02:03 PM, Lukas Slebodnik wrote:
>>                            Active Directory Server 2008 and later.
>>                          </para>
>>                          <para>
>>-                            Default: True
>>+                            Default: True for AD and IPA.
>>                          </para>
>>                      </listitem>
>
>If you do not mention LDAP provider, it does not automatically
>imply that it is false. IMO it would be better to explicitly
>write it.
>
As you wish.

LS
-------------- next part --------------
>From 197ec47bbb1586ed04eb19d147b71688bbab89a1 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Fri, 7 Nov 2014 13:58:17 +0100
Subject: [PATCH] LDAP: Disable token groups by default

We tried to speed up processing of initgroup lookups with tokenGroups even for
the LDAP provider (if remote server is Active Directory), but it turns out that
there are too many corner cases that we didn't catch during development that
break. For instance, groups from other trusted domains might appear in TG and
the LDAP provider isn't equipped to handle them.

Overall, users who wish to use the added speed benefits of tokenGroups are
advised to use the AD provider.

Resolves:
https://fedorahosted.org/sssd/ticket/2483
---
 src/man/sssd-ldap.5.xml        | 2 +-
 src/providers/ldap/ldap_opts.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 2dcf7e3f8ab5c307e0262efdebfc148c30ea3679..d7a2a4ac9fa2497a4c347a2a7e77703e53b8a46c 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1022,7 +1022,7 @@
                           Active Directory Server 2008 and later.
                         </para>
                         <para>
-                            Default: True
+                            Default: True for AD and IPA otherwise False.
                         </para>
                     </listitem>
                 </varlistentry>
diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h
index dedbdac0bcf647337d4c00b1fbb82d6b46be5b54..f46381e9fac7b93730ce0767154989f2e3b7ebbf 100644
--- a/src/providers/ldap/ldap_opts.h
+++ b/src/providers/ldap/ldap_opts.h
@@ -116,7 +116,7 @@ struct dp_option default_basic_opts[] = {
     { "ldap_idmap_default_domain_sid", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
-    { "ldap_use_tokengroups", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE},
+    { "ldap_use_tokengroups", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE},
     { "ldap_rfc2307_fallback_to_local_users", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_disable_range_retrieval", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ldap_min_id", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER},
-- 
2.1.0



More information about the sssd-devel mailing list