sssd-devel June 2016

sssd-devel@lists.fedorahosted.org

11 participants
64 discussions

[PATCH] confdb: Check for config file errors on sssd startup
by Lukas Slebodnik 27 Jun '16

27 Jun '16

ehlo The first patch is sligtly modified version of Michal's patch. It depends on patch for config snippet. Because config validation is optional if it isn't supported in libini_config. And detection for new libini_config is in patch for config snippets You might see "typos" in sssd.log e.g. (Thu Jun 23 10:48:39:370079 2016) [sssd] [sss_ini_call_validators] (0x0020): [rule/allowed_domain_options]: Attribute 'ldapi_uri' is not allowed in section 'domain/example.com'. Check for typos. BTW don't forget to build with ding-libs-0.6 (libini_config 1.3.0) LS

3 14

[PATCH] confd: Make it possible to use config snippets
by Lukas Slebodnik 27 Jun '16

27 Jun '16

ehlo, Attached is a sligtly modified version of Michal's patch. I fixed few coding style issues + added missing creation of directory + spec file change. You might notice that Michal removed detection of sssd.conf modified time. It is because mtime could be obtiained from sssd.conf before parsing. However, snippets files are open after parsing sssd.conf and mtime of snippet files is ignored in the process. We have few options. * check mtime directly in sssd * add new function to libini_config to get latest mtime before parsing (max_mtime(main.conf + alowed snippet files) // it's little bit a complication for user of libini_config // because user will need to paste regex for allowed snippets twice // 1st time in new function for checking mtime and 2nd time in function // ini_config_augment * modify libini_config to set max mtime while parsing snippet files // but we will need to parse files anyway. So I'm not sure what will be // benefit of cehcking mtime after parsing. * last option is to ignore mtime. (Michal's current version) // and remove FIXME :-) The main purpose of this mail is to decide wheteer we want change in ding-libs or no. BTW. We cannot change directory for snippet files from command line. Do we want such feature? [root@graviton ~]# /usr/sbin/sssd --help Usage: sssd [OPTION...] -d, --debug-level=INT Debug level -f, --debug-to-files Send the debug output to files instead of stderr --debug-timestamps=INT Add debug timestamps --debug-microseconds=INT Show timestamps with microseconds -D, --daemon Become a daemon (default) -i, --interactive Run interactive (not a daemon) -c, --config=STRING Specify a non-default config file --version Print version number and exit Help options: -?, --help Show this help message --usage Display brief usage message LS

4 30

[PATCH] Pavel's sssctl work
by Jakub Hrozek 27 Jun '16

27 Jun '16

Hi, Pavel's sssctl tool is at: https://fedorapeople.org/cgit/pbrezina/public_git/sssd.git/log/?h=sssctl I'll try to have a first pass at review today in the evening, but I thought I'll pass on the branch in case anyone else is interested..

4 18

release notes for the 1.14 beta release
by Jakub Hrozek 27 Jun '16

27 Jun '16

Hi, I prepared release notes for the beta release: https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0beta I wanted to release the tarball today, but I would also like to push the secrets responder and wait for CI to finish..let's try tomorrow.

2 2

[PATCH] Add winbind idmap plugin
by Sumit Bose 24 Jun '16

24 Jun '16

Hi, this patch adds a new plugin similar to the one for the cifs-utils which allows winbind to use the same id-mapping as SSSD. Currently I only added it to the dlopen test because I think it would be best to test it directly when Samba becomes available in the CI. bye, Sumit

4 10

I renamed the 1.15 milestone to 1.16, the new 1.15 tracks Fedora 25 development
by Jakub Hrozek 23 Jun '16

23 Jun '16

Hi, ssia, mostly. The previous 1.15 bucket was just a huge ball of everything we want to work on for the next release. But we're looking at some enhancements sooner, in time for Fedora 25, so I just shifted the version numbers and will add some tickets that we would like to include in Fedora 25 to the new 1.15 milestone. Whether we will call the next version 1.15 or 2.0 or something else is a detail we can sort out later, but for now the idea is that it would be better visible what we are planning for F-25 if we have a smaller milestone.

1 0

[PATCH] Improve sysdb write performance
by Jakub Hrozek 23 Jun '16

23 Jun '16

Hi, the attached patchset improves SSSD by performance by adding a second ldb cache file that is opened with LDB_FLG_NOSYNC and contains empeheral data like timestamps. The reason is to avoid updating the sync-cache in case nothing in fact changed and SSSD is only refreshing the cache to add new timestamps. Especially for group lookups, this can improve performance a bit. The first lookup, or any where the actual data changes is still slow, though. I don't have a CI link yet, because I'm having issues installing pyldb on our test machines. The last patch doesn't touch sysdb, but the LDAP provider. I hope it's fine to include it in the same set, though. The full design document is at: https://fedorahosted.org/sssd/wiki/DesignDocs/OneFourteenPerformanceImprove… I tried to keep the operations contained to the sysdb interface itself, no provider or responder changes were required. To test, you can use the systemtap scripts I sent earlier to the list. For my test user who is a member of about ~200 groups, each containing several hundred members, running 'id' with an empty cache takes: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Total run time of id was: 8581 ms Number of zero-level cache transactions: 166 Time spent in level-0 sysdb transactions: 6045 ms Time spent writing to LDB: 2550 ms Number of LDAP searches: 326 Time spent waiting for LDAP: 1780 ms LDAP searches breakdown: Number of user requests: 1 Time spent in user requests: 20 Number of group requests: 162 Time spent in group requests: 7965 Number of initgroups requests: 1 Time spent in initgroups requests: 115 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Without the patches, the updates take about the same time as filing the empty cache. With the patches, when the cache is expired with "sss_cache -E" and refreshed: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Total run time of id was: 3934 ms Number of zero-level cache transactions: 165 Time spent in level-0 sysdb transactions: 1404 ms Time spent writing to LDB: 6 ms Number of LDAP searches: 326 Time spent waiting for LDAP: 1756 ms LDAP searches breakdown: Number of user requests: 1 Time spent in user requests: 3 Number of group requests: 162 Time spent in group requests: 3377 Number of initgroups requests: 1 Time spent in initgroups requests: 39 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ With the patches, the group lookups performance analysis looks like this: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Time spent in group sssd_be searches: 3570 Time spent in sdap_nested_group_send/recv: 1609 ms (ratio: 45.07%) Time spent in zero-level sysdb transactions: 1694 ms (ratio: 47.45%) Breakdown of sdap_nested_group req (total: 1609 ms) sdap_nested_group_process req: 1608 sdap_nested_group_process_split req: 152 sdap_nested_group_check_cache: 147 sdap_nested_group_sysdb_search_users: 94 sdap_nested_group_sysdb_search_groups: 49 ldap request breakdown of total 1405 sdap_nested_group_deref req: 1455 sdap_deref_search_send req 1405 processing deref results: 50 sdap_nested_group_lookup_user req: 0 sdap_nested_group_lookup_group req: 0 Time spent refreshing unknown members: 0 Breakdown of results processing (total 1694) Time spent populating nested members: 1454 Time spent searching ldb while populating nested members: 1328 Time spent saving nested members: 145 Time spent writing to the ldb: 9 ms ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Apparently, we still can improve the sdap_async.c module to do fewer cache lookups and optimize the dereference results processing to not parse all received attributes if the modifyTimestamp is the same as we already have stored in the cache. But I think the attached patchset already improves the situation quite a bit and can be reviewed on its own. So far I tested IPA client and AD client. I still need to test the IPA server itself and run downstream tests. But I don't think this needs to block the review.

3 8

Announcing ding-libs 0.6.0
by Jakub Hrozek 22 Jun '16

22 Jun '16

A new version of ding-libs was released today! ding-libs, or "Ding is not GLib" is a a set of helpful libraries used by projects such as SSSD or gss-proxy. The tarball can be downloaded from: https://fedorahosted.org/sssd/wiki/Releases == Highlights == * libini_config * libini now supports validators that check for well-formed INI files. Please see the Doxygen documentation for more details on using the new functions. The new functions include: * ini_rules_read_from_file * ini_rules_check * ini_rules_destroy * ini_errobj_* == Note for distribution packagers == * API and ABI is backward compatible with last release (0.5.0) == Detailed Changelog == Dmitri Pal (1): * ini: Add INI_PARSE_IGNORE_NON_KVP flag Lukas Slebodnik (6): * INI: Enable string format check for ini_errobj_add_msg * INI: Extend validator unit test for corner cases * INI: Reduce count of argumets for ini_rules_check * INI: Prepare for schema validation * Bump version-info * Update versions before 0.6.0 release Michal Židek (6): * ini_parse: Add missing TRACE_FLOW_EXIT * Add unit test for INI_PARSE_IGNORE_NON_KVP * ini: Add infrastructure for validators * ini: Add internal validator ini_allowed_options * tests: Tests for rules/validators infrastructure * ini: Add internal validator allowed_sections Robbie Harwood (3): * Document ini_config_augment alphabetical file processing * Fix comment in ini_augment_ut.c * Ensure ding-linbs metapackage depends on libbasicobjects

1 0

[ding-libs] [PATCH] ini: Add infrastructure for validators
by Lukas Slebodnik 22 Jun '16

22 Jun '16

ehlo, The first 4 patches are slightly modified version of Michal's patches. Mostly coding style issues, fixed reports from static analyzers + fixed small issues which would be fixed as part of review process. Last two patches are optional improvements which changes ofiginal API. It was not discussed as part of desing review but these ideas come to my mind as a part or reading code. Please review patches. LS

2 5

release notes for the ding-libs 0.6.0 release
by Jakub Hrozek 22 Jun '16

22 Jun '16

Hi, I prepared very simple release notes for ding-libs 0.6.0: https://fedorahosted.org/sssd/wiki/Releases/DingNotes-0.6.0

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel June 2016