diff options
| author | Lukas Slebodnik <lslebodn@redhat.com> | 2014-11-07 13:58:17 +0100 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2014-11-12 17:48:14 +0100 |
| commit | 5febf5ed0cfb4ba7665d8c3e36ee6941988da773 (patch) | |
| tree | fcc911d6ec28e1d219f76f5b24e9ee09dd216e63 /src | |
| parent | 494b227b13bb635b8ed03ce94b674ae87009681e (diff) | |
| download | sssd-5febf5ed0cfb4ba7665d8c3e36ee6941988da773.tar.gz sssd-5febf5ed0cfb4ba7665d8c3e36ee6941988da773.tar.xz sssd-5febf5ed0cfb4ba7665d8c3e36ee6941988da773.zip | |
LDAP: Disable token groups by default
We tried to speed up processing of initgroup lookups with tokenGroups even for
the LDAP provider (if remote server is Active Directory), but it turns out that
there are too many corner cases that we didn't catch during development that
break. For instance, groups from other trusted domains might appear in TG and
the LDAP provider isn't equipped to handle them.
Overall, users who wish to use the added speed benefits of tokenGroups are
advised to use the AD provider.
Resolves:
https://fedorahosted.org/sssd/ticket/2483
Reviewed-by: Michal Židek <mzidek@redhat.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/man/sssd-ldap.5.xml | 2 | ||||
| -rw-r--r-- | src/providers/ldap/ldap_opts.h | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml index 2dcf7e3f8..d7a2a4ac9 100644 --- a/src/man/sssd-ldap.5.xml +++ b/src/man/sssd-ldap.5.xml @@ -1022,7 +1022,7 @@ Active Directory Server 2008 and later. </para> <para> - Default: True + Default: True for AD and IPA otherwise False. </para> </listitem> </varlistentry> diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h index dedbdac0b..f46381e9f 100644 --- a/src/providers/ldap/ldap_opts.h +++ b/src/providers/ldap/ldap_opts.h @@ -116,7 +116,7 @@ struct dp_option default_basic_opts[] = { { "ldap_idmap_default_domain_sid", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, - { "ldap_use_tokengroups", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE}, + { "ldap_use_tokengroups", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE}, { "ldap_rfc2307_fallback_to_local_users", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "ldap_disable_range_retrieval", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "ldap_min_id", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER}, |