[SSSD-users] Avoid (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))

Simo Sorce simo at redhat.com
Sat May 10 19:07:52 UTC 2014

On Sat, 2014-05-10 at 16:27 +0200, Michael Ströder wrote:
> HI!
> I'm seeing searches like this sent by sssd to the LDAP server:
> (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
> Likely this is because some of the server admins set in sssd.conf:
> enumerate = true
> While it's debatable to disable enumeration I wonder how one can avoid that
> sssd uses the filter above.
> Since all three attributes are mandantory in objectClass posixAccount anyway
> it would be sufficient to do a user numeration search just with filter
> (objectClass=posixAccount) because there cannot be an entry without any of
> these attributes.
> I'm asking because it turned out that the LDAP server's processing of
> (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*)) is two times
> slower than just (objectClass=posixAccount).

Please open a ticket, it is a reasonable optimization we should make
available to all users.


Simo Sorce * Red Hat, Inc * New York

More information about the sssd-users mailing list