Re: Can I list all users defined in LDAP (on RHEL6 or Fedora) ?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Stephen Gallagher píše v St 04. 01. 2012 v 07:31 -0500:
> On Wed, 2012-01-04 at 12:03 +0100, Pavel Lisy wrote:
> > Stephen Gallagher píše v Út 03. 01. 2012 v 16:10 -0500:
> > > On Tue, 2012-01-03 at 15:51 -0500, Peter Larsen wrote:
> > > > Pavel,
> > > > Are you sure the LDAP server allows listing all users? It's quite normal
> > > > to turn that off.
> > > 
> > > By default, SSSD doesn't allow listing all users/groups because it
> > > presents significant load on the server. You can enable it by adding
> > > 'enumerate = True' to the [domain/default] section
> > > of /etc/sssd/sssd.conf and then restarting SSSD (with 'service sssd
> > > restart')
> > It was it thanks a lot. My LDAP DB is not big so performance is not problem.
> > 
> > > In general, you probably want to review what your scripts are doing and
> > > see if you can't make them more efficient by using specific lookups.
> > 
> > I use it to get list of all active users to create homedirs and ssh keys
> > for them (for example). It is much simpler to use shell utils than write
> > perl script to connect to LDAP directly.
> > 
> > Is it possible to set sssd to list only active users - set custom
> > filter? Now it lists all users (inactive include samba/computer
> > accounts)
> > 
> > I use this filter in /etc/ldap.conf now:
> > nss_base_passwd   ou=People,dc=company,dc=org?one?|(sambaAcctFlags=[UX])
> > 
> > I've found only this:
> > access_provider = ldap
> > ldap_access_filter = sambaAcctFlags=[UX]
> > 
> > but it doesn't change list of 
> > getent passwd
> > 
> > Any idea how to solve it?
> 
> 
> We just added this feature in SSSD 1.7.0 (which I'm going to be putting
> in updates-testing for F16 today). You'll be able to do:
> 
> ldap_user_search_base =
> ou=People,dc=company,dc=org?one?(sambaAcctFlags=[UX])
> 
> ldap_group_search_base =
> ou=Groups,dc=company,dc=org?one?|(sambaAcctFlags=[UX])

Excelent! 

I've just found in (fedora) documentation that it is possible 
filter it by:
ldap_user_search_filter = (sambaAcctFlags=[UX]

It works in sssd-1.6.3 (my F16).

But I've tried it (and need it too) in RHEL6/CentOS6 and there is older
version sssd-1.5.1-66 which doesn't support this feature yet. 

Do you think you/they will increase version of sssd in next RHEL update
(6.3)? 
I suppose not. So I'll need to disable sssd and use nss-pam-ldapd
instead.


Pavel


-- 
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org


[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [EPEL Devel]     [Fedora Magazine]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Desktop]     [Fedora Fonts]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Fedora Sparc]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux