[SSSD] Design Discussion: Domains, users and groups over D-Bus

Jakub Hrozek jhrozek at redhat.com
Tue Jan 13 08:44:47 UTC 2015


On Mon, Jan 12, 2015 at 03:40:33PM -0500, Dmitri Pal wrote:
> On 01/12/2015 03:18 PM, Jakub Hrozek wrote:
> >On Mon, Jan 12, 2015 at 02:17:46PM -0500, Dmitri Pal wrote:
> >>On 01/12/2015 09:51 AM, Pavel Březina wrote:
> >>>On 12/16/2014 02:26 PM, Pavel Březina wrote:
> >>>>https://fedorahosted.org/sssd/wiki/DesignDocs/DBusResponder
> >>>I created a new design page to reduce size and increase readability in the
> >>>original one. I would like to keep DBusResponder page mainly as a
> >>>crossroad with links to other pages in the future so it is not swamped
> >>>with too many details on everything.
> >>>
> >>>I will replace user and group design in DBusResponder with the following
> >>>link if you agree:
> >>>
> >>>https://fedorahosted.org/sssd/wiki/DesignDocs/DBusUsersAndGroups
> >>>
> >>>It should cover everything we agreed on. If not, please tell me and I will
> >>>add it.
> >>>
> >>>_______________________________________________
> >>>sssd-devel mailing list
> >>>sssd-devel at lists.fedorahosted.org
> >>>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >>1) There is a difference between allowing a wild card in a string and
> >>allowing it at the beginning or at end.
> >>In the latter case you can use much fast searches such as "begins with" and
> >>"ends with" or "contains" if you have *foo*.
> >>I think it should be explicit whether we allow regex or not becuase an
> >>asterisk in general would require regex.
> >>I thought we said we want to avoid regex.
> >>
> >>2) In the min length configuration options please be explicit that we are
> >>talking about non wild card characters in the string.
> >I must have missed why do we have these options at all? The design page
> >doesn't specify it either. Is it to avoid thrashing the LDAP server with
> >searches too wide?
> 
> Yes. It was in the discussion. We do not want user to provide one letter and
> get tons of responses.
> However we can also do a different thing, we can limit the number of results
> returned and never return over some hard coded limit, for example, 300. With
> the default 30.

OK, that makes total sense, but care must be taken to return a nice
error string if the admin uses a shorter filter.



More information about the sssd-devel mailing list