Re: Still testing needed: New passwd/group AD/SAM integration

[Andrey Repin <anrdaemon at yandex dot ru>]

Greetings, Corinna Vinschen!

> The latest snapshot, 2014-04-10, is a snapshot from CVS HEAD again.
> It contains the latest crazy ideas in terms of the user and group
> account creation without requiring the /etc/passwd and /etc/group
> files.

> Not a lot has changed since we made a break to test for 1.7.29,
> but there's one important change I'd like to point out:

> * cygserver now provides system-wide passwd/group entry caching.

>   All processes started *after* cygserver will try to fetch passwd
>   and group entries from cygserver.  While this is probably a bit
>   slow at the start, the longer cygserver runs, the more information
>   is present and later started processes will get the information
>   with all due speed.

Does this mean that I could benefit from running cygserver in local
environment?
Specifically, if I'm using Cygwin tools outside Cygwin shell?

> I attached the latest incarnation of the documentation for this
> major change to this mail.

> However!

> After sweating about some of the details I created in my scrubby mind
> back in January/February, I'm not so sure anymore if some if was really
> such a bright idea.

> Especially two problems cropped up in discussions with local Cygwin
> users:


> * Support for Cygwin user names different from the Windows username.

I think I said it before, but I'll just repeat that I don't see this as a
feature.
Confusion option, at best. The worst case you've just outlined below.

>   Fixing this problem leads to terrible performance.  Obviously Cygwin
>   doesn't know if "yoghurt" is a local or an AD account.  Or, FWIW, an
>   account in some trusted domain.  Finding "kefir" in the SAM of the
>   local machine requires to enumerate *all* accounts, until the account
>   with
>   
>     <cygwin name="kefir" .../>
> 
>   is found.  Even worse in AD.  An ldap query is required which searches
>   for an account with uid="kefir".  The uid attribute is not indexed by
>   default.  Same for all trusted domains.


> * db_separator in /etc/nsswitch.conf

>   Is it really such a good idea to have a configurable separator
>   char in user and group names?  Is it important that it is
>   configurable?  Is '+' a good choice for the default separator?
>   Wouldn't the backslash a better and, perhaps, only choice?

The "+" as a separator was conceived in *NIX because backslash has a long
history of being a way-too-meaningful escape character.
(Though, you know it, I'll just say it for other interested parties.)
I don't have an opinion on it, but I tend to favor native semantics, means,
the backslash.
If anyone are familiar with modern state of preferred domain separator
in Samba 4, would that effect the decision?


--
WBR,
Andrey Repin (anrdaemon@yandex.ru) 13.04.2014, <14:11>

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple