plugin API new function: slapi_memberof
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
Hello,
Please find the slapi_memberof design under
https://www.port389.org/docs/389ds/design/slapi_memberof.html
This new slapi_memberof function in plugin API, provides a list of
entries that a given entry is member of, either directly or indirectly.
It could be reused by existing plugins (like memberof or referential
integrity). It can also be used by other component like InChain matching
rule that requires such service.
Any comments are welcome
best regards
thierry
Hi Thierry,
Although it is globally fine, I have a few comments about the design
document: related to the fact that maximum group size and depth are not
handled:
- How are membership loop handled (
I mean group A contains group B and group B contains group A
BTW We should probably add a test about that if none already exists )
- How to we prevent memory exhaustion and reasonable response time
( Nothing prevent an entry to be in millions of groups and handling
valueset with millions of values will be a nightmare )
IMHO you should add a section, explaining how these two cases are handled.
Regards,
Pierre
On Fri, Dec 16, 2022 at 6:35 PM Thierry Bordaz <tbordaz(a)redhat.com> wrote:
Hello,
Please find the slapi_memberof design under
https://www.port389.org/docs/389ds/design/slapi_memberof.html
This new slapi_memberof function in plugin API, provides a list of
entries that a given entry is member of, either directly or indirectly.
It could be reused by existing plugins (like memberof or referential
integrity). It can also be used by other component like InChain matching
rule that requires such service.
Any comments are welcome
best regards
thierry
_______________________________________________
389-devel mailing list -- 389-devel(a)lists.fedoraproject.org
To unsubscribe send an email to 389-devel-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-devel@lists.fedoraproje...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
--
--
389 Directory Server Development Team
- How to we prevent memory exhaustion and reasonable response time
( Nothing prevent an entry to be in millions of groups and handling valueset with
millions of values will be a nightmare )
This feature is being modelled off a feature from Active Directory - the same feature in
AD is "strongly discouraged from use" due to performance issues exactly as
Pierre is describing here.
So I do thing we should be careful and consider limits like this as well as performance as
a potential risk.
--
Sincerely,
William Brown
Senior Software Engineer,
Identity and Access Management
SUSE Labs, Australia
502
days inactive
523
days old
389-devel@lists.fedoraproject.org
2 comments
3 participants
tags (0)
participants (3)
-
Pierre Rogier -
Thierry Bordaz -
William Brown