Re: [PATCH] Nested groups

[Arthur de Jong <arthur [at] arthurdejong.org>]

On Mon, 2013-03-25 at 08:45 +0100, Marcus Moeller wrote:
> > For the forward lookups this shouldn't result in extra searches if
> > no nested groups are used but it will slow down the reverse search
> > because for each group found an extra search is performed. For this
> > reason a nss_nested_groups configuration option was added which can
> > be used to enable this new functionality (default is false).
> 
> I have not taken a look at the code yet, but we need to make sure that 
> this feature can either been disabled and/or the nested group depth can 
> be specified.
> 
> We got a large number of nested groups here with reverse nesting, which 
> might lead to extreme long lookup times, otherwise.

The functionality will be disabled by default and can be enabled with
nss_nested_groups as specified above.

My first approach was a nss_group_depth option to limit the depth but
after switching to the queue-based logic that became harder to
implement. Patches for a depth limit are welcome.

In any case the current code should avoid all kinds of group loops.

-- 
-- arthur - arthur@arthurdejong.org - http://arthurdejong.org --

-- 
To unsubscribe send an email to
nss-pam-ldapd-users-unsubscribe@lists.arthurdejong.org or see
http://lists.arthurdejong.org/nss-pam-ldapd-users/