[SSSD-users] Avoid (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))

Jakub Hrozek jakub.hrozek at gmail.com
Sat May 10 19:13:04 UTC 2014

Sorry, but I don't agree. The objectclass is cofigurable in sssd.conf
and especially in AD deployments it might be quite common to only have
some users configured with POSIX attributes and not the others. The
enumeration based on objectclass only would download the whole lot and
then fail while saving the users..

On Sat, May 10, 2014 at 9:07 PM, Simo Sorce <simo at redhat.com> wrote:
> On Sat, 2014-05-10 at 16:27 +0200, Michael Ströder wrote:
>> HI!
>> I'm seeing searches like this sent by sssd to the LDAP server:
>> (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
>> Likely this is because some of the server admins set in sssd.conf:
>> enumerate = true
>> While it's debatable to disable enumeration I wonder how one can avoid that
>> sssd uses the filter above.
>> Since all three attributes are mandantory in objectClass posixAccount anyway
>> it would be sufficient to do a user numeration search just with filter
>> (objectClass=posixAccount) because there cannot be an entry without any of
>> these attributes.
>> I'm asking because it turned out that the LDAP server's processing of
>> (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*)) is two times
>> slower than just (objectClass=posixAccount).
> Please open a ticket, it is a reasonable optimization we should make
> available to all users.
> Simo.
> --
> Simo Sorce * Red Hat, Inc * New York
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users

More information about the sssd-users mailing list