Re: LDAP_MATCHING_RULE_IN_CHAIN support

[johan <johan [at] nosd.in>]

Drop it, I just realised we can achieve this with a simple group mapping :
map group member member:1.2.840.113556.1.4.1941:

It's worth a note somewhere i think

Nslcd is great :-)

Le 28 janvier 2023 14:10:59 GMT+01:00, johan <johan@nosd.in> a écrit :

Hello,
First, thank you for nslcd!
We use it on some hosts, with an active directory back-end.
We use supergroups, and I find nslcd could be improved by using LDAP_MATCHING_RULE_IN_CHAIN extended operation, which is provided by active directory.
Maybe a new option value "ad" for "nss_nested_groups" could be added for enabling this recursive operation.
With this option, group_by_member filtre would be built this way :
(&(&(objectClass=group)(gidNumber=*))(|(?memberUid=myuser)(member:1.2.840.113556.1.4.1941:=cn=My User,ou=Users,dc=example,dc=intra)))

You will find attached a patch implementing these mods.

Here are the results I got on a user member of ~100 groups and supergroups:
# systemctl stop nscd

# grep -E '^nss_nested_groups' /etc/nslcd.conf
nss_nested_groups yes

# time groups myuser
myuser : Domain Users [snip]
real 0m14,810s
user 0m0,033s
sys 0m0,021s

# sed -i -E 's/^nss_nested_groups\tyes/nss_nested_groups\tad/' /etc/nslcd.conf && systemctl restart nslcd && time groups myuser
myuser : Domain Users [snip]
real 0m1,336s
user 0m0,010s
sys 0m0,036s


Do you think this could be added to nslcd?


-- Envoyé depuis /e/ Mail.

-- Envoyé depuis /e/ Mail.