files domain and getent passwd

[Patrick Riehecky]

Is there a way to get results in `getent passwd` from a files domain
with enumerate=false?

relevant domain snippet:
[domain/FNAL.GOV]
auth_provider=krb5
id_provider=files
enumerate=false


When I change from `enumerate=false` to `enumerate=true` I get
everything I'd expect from `getent passwd`.

The load time on my enormous file is painful with enumerate=true.

Pat

[External] files domain and getent passwd

[Prentice Bisbal]

On 2/22/23 4:14 PM, Patrick Riehecky wrote:
>  Is there a way to get results in `getent passwd` from a files domain
>  with enumerate=false?
>
>  relevant domain snippet:
>  [domain/FNAL.GOV]
>  auth_provider=krb5
>  id_provider=files
>  enumerate=false
>
>
>  When I change from `enumerate=false` to `enumerate=true` I get
>  everything I'd expect from `getent passwd`.
>
>  The load time on my enormous file is painful with enumerate=true.
>
>  Pat 


Are you providing a username to getent like this for user foo?

getent passwd foo

That should give you the passwd file entry for user foo when 
enumerate=false (and even when it's true!)

>  The load time on my enormous file is painful with enumerate=true.
That is why enumerate=false is the default for sssd enumerating through 
every possible value puts a huge load on SSSD, so shouldn't be used at 
sites with a large number of user accounts.

--
Prentice

[External] files domain and getent passwd

[Alexey Tikhonov]

On Wed, Feb 22, 2023 at 11:31 PM Prentice Bisbal <pbisbal(a)pppl.gov&gt; wrote:
>  On 2/22/23 4:14 PM, Patrick Riehecky wrote:
>  > Is there a way to get results in `getent passwd` from a files domain
>  > with enumerate=false?
>  >
>  > relevant domain snippet:
>  > [domain/FNAL.GOV]
>  > auth_provider=krb5
>  > id_provider=files
>  > enumerate=false
>  >
>  >
>  > When I change from `enumerate=false` to `enumerate=true` I get
>  > everything I'd expect from `getent passwd`.
>  >
>  > The load time on my enormous file is painful with enumerate=true.
>  >
>  > Pat
>
>
>
>  Are you providing a username to getent like this for user foo?
>
>  getent passwd foo
>
>  That should give you the passwd file entry for user foo when
>  enumerate=false (and even when it's true!)
>
>  > The load time on my enormous file is painful with enumerate=true.
>
>  That is why enumerate=false is the default for sssd enumerating through
>  every possible value puts a huge load on SSSD, so shouldn't be used at
>  sites with a large number of user accounts. 
Actually 'files provider' is somewhat special:
1) it always reads the entire /etc/passwd into SSSD cache, so there
should be no difference CPU load wise.
2) IIRC, 'files provider' doesn't actually respond to enumeration
request because typically there is also 'files' in 'passwd:' database
that enumerates and glibc concatenates results

From a practical point of view, for 'auth_provider=krb5' & local users
case we now tend to recommend using 'id_provider = proxy' with lib
'files'.
'Files provider' might be deprecated / removed upstream going forward.

[External] files domain and getent passwd

[Patrick Riehecky]

On Thu, 2023-02-23 at 11:21 +0100, Alexey Tikhonov wrote:
>  From a practical point of view, for 'auth_provider=krb5'
> & local
>  users
>  case we now tend to recommend using 'id_provider = proxy' with lib
>  'files'.
>  'Files provider' might be deprecated / removed upstream going
>  forward.
>  

Is there more information on this?

My federation system provides an "passwd format" file that I'm loading
via 

group_files=/etc/sssd_git/group
passwd_files=/etc/sssd_git/passwd
pwfield=*

Pat

[External] files domain and getent passwd

[Alexey Tikhonov]

On Thu, Feb 23, 2023 at 4:15 PM Patrick Riehecky <riehecky(a)fnal.gov&gt; wrote:

>  On Thu, 2023-02-23 at 11:21 +0100, Alexey Tikhonov wrote:
>  > From a practical point of view, for 'auth_provider=krb5' & local
>  > users
>  > case we now tend to recommend using 'id_provider = proxy' with lib
>  > 'files'.
>  > 'Files provider' might be deprecated / removed upstream going
>  > forward.
>
>
>  Is there more information on this?
>  
https://github.com/SSSD/sssd/pull/6572
Most probably sssd-2.9 upstream release will have a build time ./configure
option to enable/disable support of 'files provider'.
It's up to the downstream maintainer if they will keep it enabled.


>  My federation system provides an "passwd format" file that
> I'm loading
>  via
>
>  group_files=/etc/sssd_git/group
>  passwd_files=/etc/sssd_git/passwd
>  pwfield=*
>
>  
Could you please check if `sssd-proxy` with `nss-altfiles` as a lib works
for your case?