[SSSD-users] Avoid (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))

Jakub Hrozek jakub.hrozek at gmail.com
Sun May 11 14:43:35 UTC 2014


On Sat, 2014-05-10 at 21:16 +0200, Michael Ströder wrote:
> Jakub Hrozek wrote:
> > Sorry, but I don't agree. The objectclass is cofigurable in sssd.conf
> > and especially in AD deployments it might be quite common to only have
> > some users configured with POSIX attributes and not the others. The
> > enumeration based on objectclass only would download the whole lot and
> > then fail while saving the users..
> 
> You could make the whole filter configurable with
> (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*)) being the default.
> 
> Ciao, Michael.

Hm, perhaps, but there is one more detail -- if SSSD is not reading the
IDs from LDAP, but mapping them using windows SIDs, the filter is:

(&(objectclass=user_objectclass)(uid=*)(SID=*))

Sure, we could allow the filter to be configurable, but I'm afraid it
would cause more confusion than benefit...or do you see some case where
the default filter is wrong or causes some unexpected results?



More information about the sssd-users mailing list