[SSSD] Design Discussion: Domains, users and groups over D-Bus

Pavel Březina pbrezina at redhat.com
Tue Jan 13 10:08:20 UTC 2015


On 01/13/2015 09:44 AM, Jakub Hrozek wrote:
> On Mon, Jan 12, 2015 at 03:40:33PM -0500, Dmitri Pal wrote:
>> On 01/12/2015 03:18 PM, Jakub Hrozek wrote:
>>> On Mon, Jan 12, 2015 at 02:17:46PM -0500, Dmitri Pal wrote:
>>>> On 01/12/2015 09:51 AM, Pavel Březina wrote:
>>>>> On 12/16/2014 02:26 PM, Pavel Březina wrote:
>>>>>> https://fedorahosted.org/sssd/wiki/DesignDocs/DBusResponder
>>>>> I created a new design page to reduce size and increase readability in the
>>>>> original one. I would like to keep DBusResponder page mainly as a
>>>>> crossroad with links to other pages in the future so it is not swamped
>>>>> with too many details on everything.
>>>>>
>>>>> I will replace user and group design in DBusResponder with the following
>>>>> link if you agree:
>>>>>
>>>>> https://fedorahosted.org/sssd/wiki/DesignDocs/DBusUsersAndGroups
>>>>>
>>>>> It should cover everything we agreed on. If not, please tell me and I will
>>>>> add it.
>>>>>
>>>>> _______________________________________________
>>>>> sssd-devel mailing list
>>>>> sssd-devel at lists.fedorahosted.org
>>>>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>>>> 1) There is a difference between allowing a wild card in a string and
>>>> allowing it at the beginning or at end.
>>>> In the latter case you can use much fast searches such as "begins with" and
>>>> "ends with" or "contains" if you have *foo*.
>>>> I think it should be explicit whether we allow regex or not becuase an
>>>> asterisk in general would require regex.
>>>> I thought we said we want to avoid regex.

Asterisk can be present in the middle of the word in LDAP filter so we 
don't have to implement it ourselves. Or am I wrong?

>>>> 2) In the min length configuration options please be explicit that we are
>>>> talking about non wild card characters in the string.
>>> I must have missed why do we have these options at all? The design page
>>> doesn't specify it either. Is it to avoid thrashing the LDAP server with
>>> searches too wide?
>>
>> Yes. It was in the discussion. We do not want user to provide one letter and
>> get tons of responses.
>> However we can also do a different thing, we can limit the number of results
>> returned and never return over some hard coded limit, for example, 300. With
>> the default 30.

So which way should we go? We can do even both.

>
> OK, that makes total sense, but care must be taken to return a nice
> error string if the admin uses a shorter filter.





More information about the sssd-devel mailing list