|
nested group control: msg#00024ldap.padl.nss
I was testing group membership limits when I noticed an explosive behaviour regarding nested groups. I have an user who is part of 501 groups: group1 through group500 plus another one. getgrouplist() was taking a large amount of time enumerating these and I thought it was weird, because I remembered doing these tests a few years ago and it was very fast, with only a few ldap queries. It turns out nss_ldap is re-querying the ldap server looking for nested groups. First it does a query like this: "(&(objectClass=posixGroup)(|(memberUid=user500)(member=uid=user500,ou=people,dc=example,dc=com)))" (I'm using "nss_map_attribute uniqueMember member") Which returns: SEARCH RESULT tag=101 err=0 nentries=501 text= This is correct: it will list all groups that have user500 as a member and it's a single query, much better than what the id(1) command does which is enumerating all groups. But now comes the nested group part. For each group returned by that query, nss_ldap will requery the server looking for groups which have this group as a member. This results, in my case, in 501 queries to the ldap server and is slow even on a LAN. Is there a way to control or disable nested groups? What about a query like this: "(&(objectClass=posixGroup)(|(memberUid=group1)(memberUid=group2)...))" (plus the rfc2307bis attributes) |
|
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| Previous by Date: | Re: libnss-ldap authenticate with host keytab?: 00024, Luke Howard |
|---|---|
| Next by Date: | Re: nested group control: 00024, Andreas Hasenack |
| Previous by Thread: | Static Mappingsi: 00024, profplump (sent by Nabble.com) |
| Next by Thread: | Re: nested group control: 00024, Andreas Hasenack |
| Indexes: | [Date] [Thread] [Top] [All Lists] |
| News | FAQ | advertise |