[SSSD-users] Inefficient ldap query...I think (sssd 1.11.2/CentOS 7)

Nordgren, Bryce L -FS bnordgren at fs.fed.us
Tue Sep 9 17:57:40 UTC 2014



> We had this discussion before:
>
> https://lists.fedorahosted.org/pipermail/sssd-users/2014-May/001630.html
>
> With lots of fine-grained ACLs in the LDAP server (like in my setup) each
> additional assertion attribute type is a performance penalty (without
> additional benefit in my setup).

Same here. It's probably worthwhile to note that my use of fine grained ACL's is far more intense than I'd prefer because sssd has no mechanism to define cross-domain groups. More precisely, it doesn't have a vocabulary for pointing at a local ldap server which defines groups composed from multiple domains.

I've thought to point sssd at my "merged domain", but I'd lose the ability to do Kerberos authentication (need per-domain spec of Kerberos info). The choice appears to be cross-domain groups, or Kerberos (and NFSv4), but not both.

Bryce




This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.


More information about the sssd-users mailing list