logo       

nested group control: msg#00024

ldap.padl.nss

Subject: nested group control

I was testing group membership limits when I noticed an explosive
behaviour regarding nested groups.

I have an user who is part of 501 groups: group1 through group500 plus
another one.
getgrouplist() was taking a large amount of time enumerating these and I
thought it was weird, because I remembered doing these tests a few years
ago and it was very fast, with only a few ldap queries.

It turns out nss_ldap is re-querying the ldap server looking for nested
groups. First it does a query like this:
"(&(objectClass=posixGroup)(|(memberUid=user500)(member=uid=user500,ou=people,dc=example,dc=com)))"

(I'm using "nss_map_attribute uniqueMember member")

Which returns:
SEARCH RESULT tag=101 err=0 nentries=501 text=

This is correct: it will list all groups that have user500 as a member and
it's a single query, much better than what the id(1) command does which
is enumerating all groups.

But now comes the nested group part. For each group returned by that
query, nss_ldap will requery the server looking for groups which have
this group as a member. This results, in my case, in 501 queries to the
ldap server and is slow even on a LAN.

Is there a way to control or disable nested groups? What about a query like
this:

"(&(objectClass=posixGroup)(|(memberUid=group1)(memberUid=group2)...))"
(plus the rfc2307bis attributes)





<Prev in Thread] Current Thread [Next in Thread>
Google Custom Search

News | FAQ | advertise