[SSSD-users] Avoid (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))

Simo Sorce simo at redhat.com
Sat May 10 19:07:52 UTC 2014


On Sat, 2014-05-10 at 16:27 +0200, Michael Ströder wrote:
> HI!
> 
> I'm seeing searches like this sent by sssd to the LDAP server:
> 
> (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
> 
> Likely this is because some of the server admins set in sssd.conf:
> 
> enumerate = true
> 
> While it's debatable to disable enumeration I wonder how one can avoid that
> sssd uses the filter above.
> 
> Since all three attributes are mandantory in objectClass posixAccount anyway
> it would be sufficient to do a user numeration search just with filter
> (objectClass=posixAccount) because there cannot be an entry without any of
> these attributes.
> 
> I'm asking because it turned out that the LDAP server's processing of
> (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*)) is two times
> slower than just (objectClass=posixAccount).

Please open a ticket, it is a reasonable optimization we should make
available to all users.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-users mailing list