search for: murmur3

...dmap_rid if you set a low range identical to that of the low range in SSSD. SSSD determines low range for initial id slice using approximately the following algorithm IIRC: ``` uint32_t hash_val = 0; int our_slice = 0; int max_slices = 10000; int final_value = 0; int slice_size = 20000 hash_val = murmur3(sid_str, strlen(sid_str), 0xdeadbeef); our_slice = hash_val % max_slices; final_value = our_slice * slice_size +slice_size; ``` This works for the first slice, but slices after that are non-deterministic.

On 03/09/2020 20:01, Andrew Walker wrote: > Whoops, fumbled my response a bit. slice size by default is 200,000, > and to clarify the SID passed into murmur3() is the domain SID, not > SID?of individual user. Though, manpage for sssd-ad should be > consulted for precise details. My understanding though is as long as > everything fits in one slice, then you can just use RID. If you have > multiple slices, you're stuck with?non-determi...

Whoops, fumbled my response a bit. slice size by default is 200,000, and to clarify the SID passed into murmur3() is the domain SID, not SID of individual user. Though, manpage for sssd-ad should be consulted for precise details. My understanding though is as long as everything fits in one slice, then you can just use RID. If you have multiple slices, you're stuck with non-deterministic behavior from SSS...

On Thu, Sep 3, 2020 at 3:15 PM Rowland penny via samba < samba at lists.samba.org> wrote: > On 03/09/2020 20:01, Andrew Walker wrote: > > Whoops, fumbled my response a bit. slice size by default is 200,000, > > and to clarify the SID passed into murmur3() is the domain SID, not > > SID of individual user. Though, manpage for sssd-ad should be > > consulted for precise details. My understanding though is as long as > > everything fits in one slice, then you can just use RID. If you have > > multiple slices, you're stuck...

...in another response > > SSSD determines low range for initial id slice using approximately the > following algorithm IIRC: > ``` > uint32_t hash_val = 0; > int our_slice = 0; > int max_slices = 10000; > int final_value = 0; > int slice_size = 20000 > > hash_val = murmur3(sid_str, strlen(sid_str), 0xdeadbeef); > our_slice = hash_val % max_slices; > final_value = our_slice * slice_size +slice_size; > ``` > This works for the first slice, but slices after that are non-deterministic. >

On Thu, Sep 03, 2020 at 06:43:32PM +0100, Rowland penny via samba wrote: > On 03/09/2020 18:04, Johan Hattne via samba wrote: > > Dear all; > > > > Would anybody be able to tell me what the idmap configuration is to have > > Samba do the same SID-to-user/group mapping as the SSSD defaults?? I was > > convinced I saw it on this list or the wiki not too long ago,

...has some known weaknesses here. Also, my testing seems to indicate some aspects of the adaptation made these significantly worse, but I'm not entirely certain. I'm still digging there. There are now a few hashing algorithms that do significantly better in both performance and hash quality: Murmur3, CityHash, and SpookyHash. Of these, CityHash and SpookyHash are significantly faster than Murmur3, both for large keys and for very small keys. My implementation is a variation of CityHash (the original isn't suitable for the interface) which is as high quality or higher quality, and happens...