On pe, 16 maalis 2018, Ronald Wimmer via FreeIPA-users wrote:
Hi,
the IPA deployment recommendations say "Generally it is recommended to
have at least 2-3 replicas in each datacenter". Is this also true if
the vast majority of users are external ones (coming from Active
Directory)? Our AD holds up to 60000 users and we prefer mapping AD
groups instead of single users. Apart from mapped AD groups and users
real IPA users will probably stay below 100.
Your IPA masters will still be handling
authentication for IPA services
and identity requests from IPA clients. How many authentication/identity
requests per second you expect to process from IPA clients?
A default 389-ds worker count is 30. This doesn't mean 30 parallel
requests at the same time but if you have like 300 clients hitting the
same LDAP server at the same time they might have to wait in a queue to
get processed. This especially gets more important with trust setup
where all ID requests come from SSSD clients as LDAP extended operation
requests. If you see timeouts in SSSD client logs for s2n operation,
that might be a sign of a need to increase number of workers or
distribute the load by employing more replicas.
KDC sets up one worker per CPU core. Typically well-behaving GSSAPI
applications (like SSSD) should be not hitting KDC every time they need
a ticket to another service (LDAP) but when AD users login to IPA client
machines they request a Kerberos ticket to host/... service on that
machine from IPA KDCs. So depending on how many AD users will attempt to
login at the same time, you may want to re-distribute load based on the
KDC availability as well.
--
/ Alexander Bokovoy