Re: nested group control

On Thu, Mar 23, 2006 at 05:11:20PM -0300, Andreas Hasenack wrote:
> But now comes the nested group part. For each group returned by that
> query, nss_ldap will requery the server looking for groups which have
> this group as a member. This results, in my case, in 501 queries to the
> ldap server and is slow even on a LAN.

Another data point:
"su - user500" (where user500 is a user belonging to 500 supplementary
groups) takes a few minutes and generates over 10.000 operations on the
ldap server.

There really should be a way do disable nested group support. There are
tools that don't work even with it (like "id" and "groups") and ignore
the extra groups.