svn commit: samba r15698 - branches/SAMBA_3_0/source/include branches/SAMBA_3_0/source/libads branches/SAMBA_3_0/source/nsswitch trunk/source/include trunk/source/libads trunk/source/nsswitch

gd at samba.org gd at samba.org
Thu May 18 19:34:26 GMT 2006


Author: gd
Date: 2006-05-18 19:34:25 +0000 (Thu, 18 May 2006)
New Revision: 15698

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=15698

Log:
An attempt to make the winbind lookup_usergroups() call in security=ads
more scalable:

The most efficient way is to use the "tokenGroups" attribute which gives
the nested group membership. As this attribute can not always be
retrieved when binding with the machine account (the only garanteed way
to get the tokenGroups I could find is when the machine account is a
member of the "Pre Win2k Access" builtin group). 

Our current fallback when "tokenGroups" failed is looking for all groups
where the userdn was in the "member" attribute. This behaves not very
well in very large AD domains.

The patch first tries the "memberOf" attribute on the user's dn in that
case and directly retrieves the group's sids by using the LDAP Extended
DN control from the user's object.

The way to pass down the control to the ldap search call is rather
painfull and probably will be rearranged later on.

Successfully tested on win2k sp0, win2k sp4, wink3 sp1 and win2k3 r2.

Guenther

Modified:
   branches/SAMBA_3_0/source/include/ads.h
   branches/SAMBA_3_0/source/libads/ldap.c
   branches/SAMBA_3_0/source/libads/ldap_utils.c
   branches/SAMBA_3_0/source/nsswitch/winbindd_ads.c
   branches/SAMBA_3_0/source/nsswitch/winbindd_util.c
   trunk/source/include/ads.h
   trunk/source/libads/ldap.c
   trunk/source/libads/ldap_utils.c
   trunk/source/nsswitch/winbindd_ads.c
   trunk/source/nsswitch/winbindd_util.c


Changeset:
Sorry, the patch is too large (1241 lines) to include; please use WebSVN to see it!
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=15698


More information about the samba-cvs mailing list