Re: [ldapext] DBIS - new IETF drafts

Michael Ströder <michael@stroeder.com> Fri, 10 January 2014 10:40 UTC

Return-Path: <michael@stroeder.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F19F81ADF5F for <ldapext@ietfa.amsl.com>; Fri, 10 Jan 2014 02:40:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.839
X-Spam-Level:
X-Spam-Status: No, score=-2.839 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.538, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ht7TlNhzazBc for <ldapext@ietfa.amsl.com>; Fri, 10 Jan 2014 02:40:32 -0800 (PST)
Received: from srv1.stroeder.com (srv1.stroeder.com [213.240.180.113]) by ietfa.amsl.com (Postfix) with ESMTP id CAB0D1ADE84 for <ldapext@ietf.org>; Fri, 10 Jan 2014 02:40:31 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by srv1.stroeder.com (Postfix) with ESMTP id 289C6607E1; Fri, 10 Jan 2014 11:40:20 +0100 (CET)
X-Virus-Scanned: amavisd-new at stroeder.com
Received: from srv1.stroeder.com ([127.0.0.1]) by localhost (srv1.stroeder.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OYNtA0C4UUud; Fri, 10 Jan 2014 11:40:16 +0100 (CET)
Received: from [10.1.0.2] (unknown [10.1.0.2]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "Michael Str??der", Issuer "CA Cert Signing Authority" (verified OK)) by srv1.stroeder.com (Postfix) with ESMTPS id 6043D6075E; Fri, 10 Jan 2014 10:40:15 +0000 (UTC)
Message-ID: <52CFCE0B.4040802@stroeder.com>
Date: Fri, 10 Jan 2014 11:40:11 +0100
From: =?UTF-8?B?TWljaGFlbCBTdHLDtmRlcg==?= <michael@stroeder.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0 SeaMonkey/2.23
MIME-Version: 1.0
To: Simo <s@ssimo.org>
References: <1389133522.4574.30.camel@sorbet.thuis.net> <52CDBFD2.10905@proseconsulting.co.uk> <52CEC4D5.1070703@stroeder.com> <1389290636.27654.125.camel@pico.ipa.ssimo.org> <52CF0838.3060102@stroeder.com> <1389300747.27654.133.camel@pico.ipa.ssimo.org>
In-Reply-To: <1389300747.27654.133.camel@pico.ipa.ssimo.org>
X-Enigmail-Version: 1.6
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms000302000202060307000109"
Cc: ldapext@ietf.org
Subject: Re: [ldapext] DBIS - new IETF drafts
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 10 Jan 2014 10:40:34 -0000

Simo wrote:
> On Thu, 2014-01-09 at 21:36 +0100, Michael Ströder wrote:
>> Simo wrote:
>>> On Thu, 2014-01-09 at 16:48 +0100, Michael Ströder wrote:
>>>> Resolving nested group membership is a big performance cost. I can see this
>>>> with a MS Sharepoint installation working with a OpenLDAP server. Sharepoint
>>>> sends many search requests even though nested groups are not used in this
>>>> deployment.
>>>
>>> Performance issues with nested groups can easily be solved via caching
>>> and the deref control though.
>>
>> But the deref control gives you only one level. Speaking of nested groups in
>> general people mean more than just two-level group memberships.
> 
> It's an 80/20 thing, the most common case is 2 levels deep, so the worst
> case is not usually a big issue.

But if you don't enforce the 2-level-nested-groups limit the client has to
search for nested groups and deref control does not help.

Ciao, Michael.