Ronald,
Thanks for the numbers. May I also ask which tuning measures you are
using on the IPA server side?
(
https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-larg...
)
Certainly. Please see below.
# Server SSSD
subdomain_inherit =
ldap_purge_cache_timeout,ignore_group_members,ldap_use_tokengroups
ldap_group_nesting_level = 0
ignore_group_members = True
ldap_use_tokengroups = False
subdomain_enumerate = none
ldap_purge_cache_timeout = 1800
entry_cache_timeout = 60
ldap_connection_expire_timeout = 1800
# Client SSSD
subdomain_inherit =
ldap_purge_cache_timeout,ignore_group_members,ldap_use_tokengroups
ignore_group_members = TRUE
ldap_use_tokengroups = FALSE
subdomain_enumerate = none
entry_cache_timeout = 14400
Our AD domain also has multiple trust domains which are searched, i.e.
domain1.ad.domain, domain2.ad.domain, domain3.ad.domain, etc. Since
all users belong to domain1.ad.domain by default, we disabled the
remaining trust domains so that only domain1.ad.domain is ever
searched for users, i.e. `ipa trustdomain-disable domain2.ad.domain`,
`ipa trustdomain-disable domain3.ad.domain`, etc. I believe the
latter greatly improved lookup speeds for obvious reasons.
And, depending on the type of client host (think login node, compute
node, etc.), we will adjust the [nss] memcache_timeout value so that
entries are constantly in the cache. To give you an example, our
SLURM controller has a 12 hour memory cache. This alleviates latency
during its enumeration when the controller restarts.
HTH,
John DeSantis
Il giorno ven 10 dic 2021 alle ore 03:50 Ronald Wimmer via
FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> ha scritto:
>
> On 09.12.21 15:47, John Desantis via FreeIPA-users wrote:
> > Ron,
> >
> >> I am sorry. Yes, the question was directed to you. Thanks for sharing
> >> these details. May I ask how large your AD is (approx. number of users)?
> >
> > No need to apologize!
> >
> > I just asked one of our AD administrators and he said there are close
> > to 800,000 users.
>
Thanks for the numbers. May I also ask which tuning measures you are
using on the IPA server side?
(
https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-larg...
)
>
> Cheers,
> Ronald
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure