Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2013-05-31 Thread Jakub Hrozek
On Thu, Nov 15, 2012 at 08:01:34PM +0100, Jakub Hrozek wrote: Currently just head, we might backport it later. I try to keep the 1.9 brach quite close to the RHEL6.4 codebase. This option is really handy and used by many users. Any opposition against pushing it to the 1.9 branch?

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2013-05-31 Thread Dmitri Pal
On 05/31/2013 06:14 AM, Jakub Hrozek wrote: On Thu, Nov 15, 2012 at 08:01:34PM +0100, Jakub Hrozek wrote: Currently just head, we might backport it later. I try to keep the 1.9 brach quite close to the RHEL6.4 codebase. This option is really handy and used by many users. Any opposition

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2013-05-31 Thread Jakub Hrozek
On Fri, May 31, 2013 at 10:23:00AM -0400, Dmitri Pal wrote: On 05/31/2013 06:14 AM, Jakub Hrozek wrote: On Thu, Nov 15, 2012 at 08:01:34PM +0100, Jakub Hrozek wrote: Currently just head, we might backport it later. I try to keep the 1.9 brach quite close to the RHEL6.4 codebase. This

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2013-05-31 Thread Jakub Hrozek
On Fri, 2013-05-31 at 16:27 +0200, Jakub Hrozek wrote: On Fri, May 31, 2013 at 10:23:00AM -0400, Dmitri Pal wrote: On 05/31/2013 06:14 AM, Jakub Hrozek wrote: On Thu, Nov 15, 2012 at 08:01:34PM +0100, Jakub Hrozek wrote: Currently just head, we might backport it later. I try to keep the

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-16 Thread Simo Sorce
Sorry for the OT ... On Thu, 2012-11-15 at 20:01 +0100, Jakub Hrozek wrote: They slipped through the review, most probably. There's no hard rule, the 80-char limit just makes the code more readable for people like me who like to split their terminals vertically. Although I am not an emacs

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-15 Thread Stephen Gallagher
On Wed 14 Nov 2012 06:39:06 PM EST, Paul B. Henson wrote: On 11/14/2012 1:41 PM, Stephen Gallagher wrote: Minor: Please use the new SSSDBG macros in confdb_get_domain_internal(). You don't need to update the existing code, but all new code should use the macros. See util.h for a listing of

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-15 Thread Jakub Hrozek
On Thu, Nov 15, 2012 at 10:47:10AM -0800, Paul B. Henson wrote: On 11/15/2012 5:45 AM, Stephen Gallagher wrote: This is obviously already a significant enhancement, and of course the difference will be more pronounced for much larger environments. I'm prepared to give this an ack, with one

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-15 Thread Jakub Hrozek
On Thu, Nov 15, 2012 at 08:01:34PM +0100, Jakub Hrozek wrote: On Thu, Nov 15, 2012 at 10:47:10AM -0800, Paul B. Henson wrote: On 11/15/2012 5:45 AM, Stephen Gallagher wrote: This is obviously already a significant enhancement, and of course the difference will be more pronounced for much

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-15 Thread Paul B. Henson
On Thu, Nov 15, 2012 at 08:01:34PM +0100, Jakub Hrozek wrote: Yes, this is in fact the best way to go. Bugzillas coming from paying customers tend to get higher priority. Thanks for pushing the commit. I've started making noise on my support case and the redhat bugzilla (looks like you saw the

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-14 Thread Stephen Gallagher
On Wed 14 Nov 2012 01:24:15 AM EST, Paul B. Henson wrote: On Nov 13, 2012, at 9:06 PM, Simo Sorce s...@redhat.com wrote: Well my concern is allowing people to get the perf. benefit you need, as you may not be the only one who needs it, w/o causing issues for those apps that will use

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-14 Thread Simo Sorce
On Wed, 2012-11-14 at 08:48 -0500, Stephen Gallagher wrote: On Wed 14 Nov 2012 01:24:15 AM EST, Paul B. Henson wrote: On Nov 13, 2012, at 9:06 PM, Simo Sorce s...@redhat.com wrote: Well my concern is allowing people to get the perf. benefit you need, as you may not be the only one who

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-14 Thread Simo Sorce
On Wed, 2012-11-14 at 10:59 -0800, Paul B. Henson wrote: On Wed, Nov 14, 2012 at 09:04:24AM -0500, Simo Sorce wrote: Ok, put down this way it tips my opinion toward the currently proposed patch. Cool. Is there anything else I need to do to move this forward? No we just need someone to

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-14 Thread Stephen Gallagher
On Wed 14 Nov 2012 02:28:07 PM EST, Simo Sorce wrote: On Wed, 2012-11-14 at 10:59 -0800, Paul B. Henson wrote: On Wed, Nov 14, 2012 at 09:04:24AM -0500, Simo Sorce wrote: Ok, put down this way it tips my opinion toward the currently proposed patch. Cool. Is there anything else I need to do

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-14 Thread Paul B. Henson
On 11/14/2012 1:41 PM, Stephen Gallagher wrote: Minor: Please use the new SSSDBG macros in confdb_get_domain_internal(). You don't need to update the existing code, but all new code should use the macros. See util.h for a listing of them. Done. ../src/providers/ldap/sdap.h:481:5: note:

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-13 Thread Paul B. Henson
On 11/12/2012 4:12 AM, Jakub Hrozek wrote: Thank you for the contribution! I will take a look at the patch..can you just send the patch as output of git format-patch in the future? It's easier for us to handle that way. As per the documentation and the configAPI -- you can either let us

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-13 Thread Paul B. Henson
The trickiest piece of this functionality would be ensuring that we don't delete existing member/memberOf linkages from the cache during group lookups that were put there by previous initgroups() requests. Thus, when this option is in play, member/memberOf should only be managed by

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-13 Thread Paul B. Henson
On Tue, Nov 13, 2012 at 08:08:20PM -0500, Simo Sorce wrote: Is this part really necessary ? If you do not fetch members from LDAP then memberuid will usually be empty anyway. In any case even if there is something (initgroups ?) then what you have there is only members that actually have

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-13 Thread Simo Sorce
On Tue, 2012-11-13 at 17:59 -0800, Paul B. Henson wrote: On Tue, Nov 13, 2012 at 08:08:20PM -0500, Simo Sorce wrote: Is this part really necessary ? If you do not fetch members from LDAP then memberuid will usually be empty anyway. In any case even if there is something (initgroups ?)

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-13 Thread Paul B. Henson
On Nov 13, 2012, at 9:06 PM, Simo Sorce s...@redhat.com wrote: Well my concern is allowing people to get the perf. benefit you need, as you may not be the only one who needs it, w/o causing issues for those apps that will use getgrnam() or getgrgid() to check stuff. If you have a reliance on

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-12 Thread Jakub Hrozek
On Fri, Nov 09, 2012 at 08:05:02PM -0800, Paul B. Henson wrote: I'm attaching an initial draft of the implementation of ignore_group_members per ticket #1376. I still need to update the documentation (and some python code in SSSDConfig it looks like), but functionality wise this prevents ldap