On Wed, 2012-01-04 at 13:51 +0100, Pavel Lisy wrote: > Stephen Gallagher píše v St 04. 01. 2012 v 07:31 -0500: > > On Wed, 2012-01-04 at 12:03 +0100, Pavel Lisy wrote: > > > Stephen Gallagher píše v Út 03. 01. 2012 v 16:10 -0500: > > > > On Tue, 2012-01-03 at 15:51 -0500, Peter Larsen wrote: > > > > > Pavel, > > > > > Are you sure the LDAP server allows listing all users? It's quite > > > > > normal > > > > > to turn that off. > > > > > > > > By default, SSSD doesn't allow listing all users/groups because it > > > > presents significant load on the server. You can enable it by adding > > > > 'enumerate = True' to the [domain/default] section > > > > of /etc/sssd/sssd.conf and then restarting SSSD (with 'service sssd > > > > restart') > > > It was it thanks a lot. My LDAP DB is not big so performance is not > > > problem. > > > > > > > In general, you probably want to review what your scripts are doing and > > > > see if you can't make them more efficient by using specific lookups. > > > > > > I use it to get list of all active users to create homedirs and ssh keys > > > for them (for example). It is much simpler to use shell utils than write > > > perl script to connect to LDAP directly. > > > > > > Is it possible to set sssd to list only active users - set custom > > > filter? Now it lists all users (inactive include samba/computer > > > accounts) > > > > > > I use this filter in /etc/ldap.conf now: > > > nss_base_passwd ou=People,dc=company,dc=org?one?|(sambaAcctFlags=[UX]) > > > > > > I've found only this: > > > access_provider = ldap > > > ldap_access_filter = sambaAcctFlags=[UX] > > > > > > but it doesn't change list of > > > getent passwd > > > > > > Any idea how to solve it? > > > > > > We just added this feature in SSSD 1.7.0 (which I'm going to be putting > > in updates-testing for F16 today). You'll be able to do: > > > > ldap_user_search_base = > > ou=People,dc=company,dc=org?one?(sambaAcctFlags=[UX]) > > > > ldap_group_search_base = > > ou=Groups,dc=company,dc=org?one?|(sambaAcctFlags=[UX]) > > Excelent! > > I've just found in (fedora) documentation that it is possible > filter it by: > ldap_user_search_filter = (sambaAcctFlags=[UX] > > It works in sssd-1.6.3 (my F16). > > But I've tried it (and need it too) in RHEL6/CentOS6 and there is older > version sssd-1.5.1-66 which doesn't support this feature yet. > > Do you think you/they will increase version of sssd in next RHEL update > (6.3)? > I suppose not. So I'll need to disable sssd and use nss-pam-ldapd > instead.
The plan for RHEL 6.3 is to rebase SSSD to 1.8.0
signature.asc
Description: This is a digitally signed message part
-- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
