On Thu, May 22, 2014 at 09:42:15AM -0400, Simo Sorce wrote: > > > Is it possible to have a user foo in domain example.com that has a > > > principal of [email protected] ? And at the same time also have a user > > > 'bar' in the same domain ? > > > Is this the case you are trying to handle ? How likely is it ? > > > > no, I think this is quite unlikely. My concern was more related to > > performance. If we decide that name@REALM is a principal because we > > didn't find user 'name' in domain 'REALM' we have to iterate over all > > configured domains and check if there is a user with the given > > principal. If the domain is known for the principal we cannot only skip > > the user lookup but can search the given domain directly. The krb5 > > localauth will be able to give the right domain in all the cases where > > the user logs in with a fully qualified name or if fully qualified names > > are used as canonical names. > > If we index the principal names, a perfect match search will be quite > fast, I do not think performance will be a big deal.
I think the performance hit comes even earlier. If you need to check if name@REALM is a user name in a domain REALM, you need to start N searches for N configured domains and only then you will start searching by the principals. _______________________________________________ sssd-devel mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
