Grouper Users - Open Discussion List

[Paul Engle <>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



- --On Thursday, May 14, 2009 4:05 PM -0500 Tom Zeller 
<>
 wrote:

>
>
>
> <source-subject-identifier source="g:gsa"
> subject-attribute="name" initial-cache-size="100003">
>
>
>  <ldap-search base="ou=pengletest,dc=rice,dc=edu"
> scope="subtree_scope" filter="(givenName={0})" />
>
> </source-subject-identifier
>
>
> replace filter="(givenName={0})" with filter="(cn={0})".
>
>
>
>
> No, the filter "cn={0}" doesn't work when provisioning with
> structure="bushy", I was quite wrong.
>
>
> It really is silly for ldappc to lookup group DNs when it
> itself creates them. I'll see what I can do to speed up
> resolving groups to DNs.
>
>
> In any case, is givenName indexed ?
>
>
> TomZ


Right, we want a bushy structure, but we still wanted access to 
the colon-delimited version of the name, because that's more 
convenient for some applications. So I decided to store that as 
givenName. It is fully indexed, just like cn.

However, I can't think of a reason why we would want to know 
about member groups from the ldap side. All of our usage is 
going to be based on knowing whether a person is in a given 
group, be it direct or indirect. Given that, could I avoid the 
extra lookups altogether if I just remove the 
<source-subject-identifier> entry for the g:gsa source? Much of 
our automatically-generated group struture relies on 
member-groups in the definitions; eliminating all those lookups 
may make a significant difference.

  -paul


- -- 
Paul D. Engle              |  Rice University
Sr. Systems Administrator  |  Information Technology - MS119
(713)348-4702              |  PO Box 1892

            |  Houston, TX 77252-1892
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFKEXb6CpkISWtyHNsRAtEnAJ0S2GlAElh3aCEoeN9HUgnWsE1AFwCgxJA6
bveYcjjgHcr/1a417+kcnDs=
=aslJ
-----END PGP SIGNATURE-----