From d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 9 Mar 2015 16:36:29 +0100 Subject: LDAP/AD: do not resolve group members during tokenGroups request During initgroups requests we try to avoid to resolve the complete member list of groups if possible, e.g. if there are no nested groups. The tokenGroups LDAP lookup return the complete list of memberships for a user hence it is not necessary lookup the other group member and un-roll nested groups. With this patch only the group entry is looked up and saved as incomplete group to the cache. This is achieved by adding a new boolean parameter no_members to groups_get_send() and sdap_get_groups_send(). The difference to config options like ldap_group_nesting_level = 0 or ignore_group_members is that if no_members is set to true groups which are missing in the cache are created a incomplete groups. As a result a request to lookup this group will trigger a new LDAP request to resolve the group completely. This way no information is ignored but the time needed to read all data is better distributed between different requests. https://fedorahosted.org/sssd/ticket/2601 Reviewed-by: Jakub Hrozek --- src/providers/ldap/ldap_common.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/providers/ldap/ldap_common.h') diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h index bf69489a7..57ad1b845 100644 --- a/src/providers/ldap/ldap_common.h +++ b/src/providers/ldap/ldap_common.h @@ -212,7 +212,8 @@ struct tevent_req *groups_get_send(TALLOC_CTX *memctx, const char *name, int filter_type, int attrs_type, - bool noexist_delete); + bool noexist_delete, + bool no_members); int groups_get_recv(struct tevent_req *req, int *dp_error_out, int *sdap_ret); struct tevent_req *ldap_netgroup_get_send(TALLOC_CTX *memctx, -- cgit