SSSD / sssd

#1578 group lookup optimisation
Closed: Invalid Opened by prefect.

Closed: Invalid
Reopen Issue

Much like #1319, I think there may be a case for trying to evaluate whether an entity is a group, user or other from the DN against a non-IPA server.

In our case this isn't simply a case of having different bases, as users and groups mingle within the AD tree, so it would need to be some form of regex match on the DN. All of our users have OU=Users lurking within their DN, so are easily distinguishable. An unreleased patch we implemented for nss_ldap made an enormous difference to performance. Recent work with tokenGroups doesn't help here, as we're using SFU attributes for uid/gid information.

This could be solved by using the "filter" option directly in the ldap_group_search_base or ldap_user_search_base.

See man sssd-ldap or for even more details RFC 2254.

design: =>
design_review: => 0
fedora_test_page: =>
resolution: => invalid
status: new => closed

Please reopen the bug if the filter option doesn't work for you. Thank you!

Metadata Update from @prefect:
- Issue set to the milestone: NEEDS_TRIAGE

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/2620

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
High
enhancement
SSSD
1.9.1
0
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.