On 6/3/20 6:10 AM, Mary Georgiou via FreeIPA-users wrote:
Dear all,
We are still experiencing issues with the memberOf plugin for which you may have some
advice.
We are constantly synchronizing accounts and groups into freeipa from external
resources.
At each time we have approx 60.000+ users and 60.000+ groups, where there are groups
with
more than 10.000 memberships.
In order to do the full first synchronization, we disabled memberOf and run the fixup
afterward.
The problem is that we are still experiencing issues with the plugin when we have an
update on groups that
requires modifying more than a certain number of memberships (more specifically the LDAP
server stops being responsive).
I read here [1] that this is because the plugin is doing lots of recomputations each time
a group is updated.
We thought of disabling the plugin for the user and group containers, and manage the
memberOf ourselves (for the group memberships only) but then there's the issue of
netgroups, roles, HBAC Rules, and sudo rules memberships.
Is there any advice on how to approach this? Any part of the configuration we should
tweak?
The only option that might help is to disable "nested groups" in
MemberOf plugin, but if you are using nested groups then you can not set
this:
https://www.port389.org/docs/389ds/design/memberof-skip-nested.html
HTH,
Mark
Thank you very much in advance,
Mary Georgiou
[1]
https://www.freeipa.org/page/V4/Performance_Improvements#memberof_fixup
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
389 Directory Server Development Team