Done.
Someone should sanity-check the documentation I put in LDAP_SASLAUTHD.
-Rob
On Thu, 9 Jan 2003, Igor Brezac wrote:
>
> On Fri, 10 Jan 2003 [EMAIL PROTECTED] wrote:
>
> > On Wed, 1 Jan 2003, Igor Brezac wrote:
> >
> > > On Wed, 1 Jan 2003 [EMAIL PROTECTED] wrote:
> > > [...]
> > > > Can anyone offer advice on tuning the saslauthd pool? Are there particular
> > > > options, either on the command line or in saslauthd.conf, which I should
> > > > be looking at?
> > >
> > > Try using 'ldap_auth_method: custom'. It is up to three times faster
> > > than the 'bind' method.
> >
> > Thanks for the suggestion. Unfortunately 'custom' wasn't an option for
> > us, although we certainly could have benefited from it. The reason we
> > can't use it is that to support password migration our shell back-end does
> > mad things like:
> >
> > try binding to new server;
> > if (failure) {
> > try binding to old server;
> > if (success)
> > update user password in new server for next time;
> > }
> >
> > Don't look at me, I just inherited it :-)
> >
> > This logic (to use the term loosely) makes it impossible to return a
> > sensible response to a search on userPassword. Instead, I committed a
> > gross hack and implemented a new method called auth_fastbind. It does away
> > with the search and extra anonymous bind in auth_bind by making two
> > assumptions:
> >
> > 1. Expanding the ldap_filter expression gives the fully-qualified DN
> > 2. There is no cost to staying bound as a named user
> >
> > These held for our shell back-end, but I don't know how applicable they
> > are to wider use. Still, if anyone's interested I've attached the patch
> > (against 2.1.10).
> >
>
> I like this patch. This can work well for quite a few people. Rob, can
> you apply this patch?
>
> --
> Igor
>
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rob Siemborski * Andrew Systems Group * Cyert Hall 207 * 412-268-7456
Research Systems Programmer * /usr/contributed Gatekeeper
