[SSSD-users] Avoid (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))

steve steve at steve-ss.com
Sun May 11 15:02:25 UTC 2014


On Sat, 2014-05-10 at 21:13 +0200, Jakub Hrozek wrote:
> Sorry, but I don't agree. The objectclass is cofigurable in sssd.conf
> and especially in AD deployments it might be quite common to only have
> some users configured with POSIX attributes and not the others. The
> enumeration based on objectclass only would download the whole lot and
> then fail while saving the users..

But in AD, posixAccount is hidden. To use a filter based upon it,
wouldn't we need to 'make it visible' by adding,
objectClass: posixAccount
to all our users who had the uidNumber, gidNumber pair in the directory?

> On Sat, May 10, 2014 at 9:07 PM, Simo Sorce <simo at redhat.com> wrote:
> > On Sat, 2014-05-10 at 16:27 +0200, Michael Ströder wrote:
> >> HI!
> >>
> >> I'm seeing searches like this sent by sssd to the LDAP server:
> >>
> >> (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
> >>
> >> Likely this is because some of the server admins set in sssd.conf:
> >>
> >> enumerate = true
> >>
> >> While it's debatable to disable enumeration I wonder how one can avoid that
> >> sssd uses the filter above.
> >>
> >> Since all three attributes are mandantory in objectClass posixAccount anyway
> >> it would be sufficient to do a user numeration search just with filter
> >> (objectClass=posixAccount) because there cannot be an entry without any of
> >> these attributes.
> >>
> >> I'm asking because it turned out that the LDAP server's processing of
> >> (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*)) is two times
> >> slower than just (objectClass=posixAccount).
> >
> > Please open a ticket, it is a reasonable optimization we should make
> > available to all users.
> >
> > Simo.
> >
> > --
> > Simo Sorce * Red Hat, Inc * New York
> >
> > _______________________________________________
> > sssd-users mailing list
> > sssd-users at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users




More information about the sssd-users mailing list