[SSSD-users] Avoid (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
Michael Ströder
michael at stroeder.com
Sat May 10 14:27:35 UTC 2014
HI!
I'm seeing searches like this sent by sssd to the LDAP server:
(&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
Likely this is because some of the server admins set in sssd.conf:
enumerate = true
While it's debatable to disable enumeration I wonder how one can avoid that
sssd uses the filter above.
Since all three attributes are mandantory in objectClass posixAccount anyway
it would be sufficient to do a user numeration search just with filter
(objectClass=posixAccount) because there cannot be an entry without any of
these attributes.
I'm asking because it turned out that the LDAP server's processing of
(&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*)) is two times
slower than just (objectClass=posixAccount).
Ciao, Michael.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2398 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20140510/4a114c58/attachment.p7s>
More information about the sssd-users
mailing list