Hi Wilfredo, --On September 8, 2008 10:52:35 AM -0700 Wilfredo Sánchez Vega <wsanchez@apple.com> wrote:
If we do this, we should be able to do all group membership checks via DS and without needing an in-memory cache.
Sounds reasonable. Some points: 1) As far as I recall DS itself does not have a "is X a member of Y" API call. Instead we have to use memberd. The PyAppleAuth module that the wiki uses has an API into memberd, though interesting they force memberd to reload its cache each time due to a purported bug. The question is whether memberd is doing anything different than what we are doing today? All we may end up doing is removing the complexity we have in favor of memberd - but then we depend on that to work properly. 2) For delegates the proper solution is to create the new "who am I a delagate for" report and cache that subset of the group memberships. That will solve the need for clients to do depth:infinity group resolutions of their own. -- Cyrus Daboo