[PATCH] confdb: Check for config file errors on sssd startup
by Lukas Slebodnik
ehlo
The first patch is sligtly modified version of Michal's patch.
It depends on patch for config snippet. Because config
validation is optional if it isn't supported in libini_config.
And detection for new libini_config is in patch for config snippets
You might see "typos" in sssd.log
e.g.
(Thu Jun 23 10:48:39:370079 2016) [sssd] [sss_ini_call_validators] (0x0020): [rule/allowed_domain_options]: Attribute 'ldapi_uri' is not allowed in section 'domain/example.com'. Check for typos.
BTW don't forget to build with ding-libs-0.6 (libini_config 1.3.0)
LS
7 years, 9 months
[PATCH] confd: Make it possible to use config snippets
by Lukas Slebodnik
ehlo,
Attached is a sligtly modified version of Michal's patch.
I fixed few coding style issues + added missing creation of directory
+ spec file change.
You might notice that Michal removed detection of sssd.conf modified time.
It is because mtime could be obtiained from sssd.conf before parsing.
However, snippets files are open after parsing sssd.conf and mtime
of snippet files is ignored in the process.
We have few options.
* check mtime directly in sssd
* add new function to libini_config to get latest mtime before parsing
(max_mtime(main.conf + alowed snippet files)
// it's little bit a complication for user of libini_config
// because user will need to paste regex for allowed snippets twice
// 1st time in new function for checking mtime and 2nd time in function
// ini_config_augment
* modify libini_config to set max mtime while parsing snippet files
// but we will need to parse files anyway. So I'm not sure what will be
// benefit of cehcking mtime after parsing.
* last option is to ignore mtime. (Michal's current version)
// and remove FIXME :-)
The main purpose of this mail is to decide wheteer we want change in ding-libs
or no.
BTW. We cannot change directory for snippet files from command line.
Do we want such feature?
[root@graviton ~]# /usr/sbin/sssd --help
Usage: sssd [OPTION...]
-d, --debug-level=INT Debug level
-f, --debug-to-files Send the debug output to files instead of
stderr
--debug-timestamps=INT Add debug timestamps
--debug-microseconds=INT Show timestamps with microseconds
-D, --daemon Become a daemon (default)
-i, --interactive Run interactive (not a daemon)
-c, --config=STRING Specify a non-default config file
--version Print version number and exit
Help options:
-?, --help Show this help message
--usage Display brief usage message
LS
7 years, 9 months
[PATCH] Add winbind idmap plugin
by Sumit Bose
Hi,
this patch adds a new plugin similar to the one for the cifs-utils which
allows winbind to use the same id-mapping as SSSD.
Currently I only added it to the dlopen test because I think it would be
best to test it directly when Samba becomes available in the CI.
bye,
Sumit
7 years, 10 months
I renamed the 1.15 milestone to 1.16, the new 1.15 tracks Fedora 25 development
by Jakub Hrozek
Hi,
ssia, mostly. The previous 1.15 bucket was just a huge ball of
everything we want to work on for the next release. But we're looking at
some enhancements sooner, in time for Fedora 25, so I just shifted the
version numbers and will add some tickets that we would like to include
in Fedora 25 to the new 1.15 milestone.
Whether we will call the next version 1.15 or 2.0 or something else is a
detail we can sort out later, but for now the idea is that it would be
better visible what we are planning for F-25 if we have a smaller
milestone.
7 years, 10 months
[PATCH] Improve sysdb write performance
by Jakub Hrozek
Hi,
the attached patchset improves SSSD by performance by adding a second
ldb cache file that is opened with LDB_FLG_NOSYNC and contains empeheral
data like timestamps. The reason is to avoid updating the sync-cache in
case nothing in fact changed and SSSD is only refreshing the cache to
add new timestamps. Especially for group lookups, this can improve
performance a bit. The first lookup, or any where the actual data
changes is still slow, though.
I don't have a CI link yet, because I'm having issues installing pyldb on
our test machines.
The last patch doesn't touch sysdb, but the LDAP provider. I hope it's
fine to include it in the same set, though.
The full design document is at:
https://fedorahosted.org/sssd/wiki/DesignDocs/OneFourteenPerformanceImpro...
I tried to keep the operations contained to the sysdb interface itself,
no provider or responder changes were required.
To test, you can use the systemtap scripts I sent earlier to the list.
For my test user who is a member of about ~200 groups, each containing
several hundred members, running 'id' with an empty cache takes:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Total run time of id was: 8581 ms
Number of zero-level cache transactions: 166
Time spent in level-0 sysdb transactions: 6045 ms
Time spent writing to LDB: 2550 ms
Number of LDAP searches: 326
Time spent waiting for LDAP: 1780 ms
LDAP searches breakdown:
Number of user requests: 1
Time spent in user requests: 20
Number of group requests: 162
Time spent in group requests: 7965
Number of initgroups requests: 1
Time spent in initgroups requests: 115
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Without the patches, the updates take about the same time as filing the
empty cache. With the patches, when the cache is expired with "sss_cache
-E" and refreshed:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Total run time of id was: 3934 ms
Number of zero-level cache transactions: 165
Time spent in level-0 sysdb transactions: 1404 ms
Time spent writing to LDB: 6 ms
Number of LDAP searches: 326
Time spent waiting for LDAP: 1756 ms
LDAP searches breakdown:
Number of user requests: 1
Time spent in user requests: 3
Number of group requests: 162
Time spent in group requests: 3377
Number of initgroups requests: 1
Time spent in initgroups requests: 39
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
With the patches, the group lookups performance analysis looks like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Time spent in group sssd_be searches: 3570
Time spent in sdap_nested_group_send/recv: 1609 ms (ratio: 45.07%)
Time spent in zero-level sysdb transactions: 1694 ms (ratio: 47.45%)
Breakdown of sdap_nested_group req (total: 1609 ms)
sdap_nested_group_process req: 1608
sdap_nested_group_process_split req: 152
sdap_nested_group_check_cache: 147
sdap_nested_group_sysdb_search_users: 94
sdap_nested_group_sysdb_search_groups: 49
ldap request breakdown of total 1405
sdap_nested_group_deref req: 1455
sdap_deref_search_send req 1405
processing deref results: 50
sdap_nested_group_lookup_user req: 0
sdap_nested_group_lookup_group req: 0
Time spent refreshing unknown members: 0
Breakdown of results processing (total 1694)
Time spent populating nested members: 1454
Time spent searching ldb while populating nested members: 1328
Time spent saving nested members: 145
Time spent writing to the ldb: 9 ms
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Apparently, we still can improve the sdap_async.c module to do fewer cache
lookups and optimize the dereference results processing to not parse all
received attributes if the modifyTimestamp is the same as we already have
stored in the cache. But I think the attached patchset already improves
the situation quite a bit and can be reviewed on its own.
So far I tested IPA client and AD client. I still need to test the IPA
server itself and run downstream tests. But I don't think this needs to
block the review.
7 years, 10 months
Announcing ding-libs 0.6.0
by Jakub Hrozek
A new version of ding-libs was released today!
ding-libs, or "Ding is not GLib" is a a set of helpful libraries used by
projects such as SSSD or gss-proxy.
The tarball can be downloaded from:
https://fedorahosted.org/sssd/wiki/Releases
== Highlights ==
* libini_config
* libini now supports validators that check for well-formed INI
files. Please see the Doxygen documentation for more details on using
the new functions. The new functions include:
* ini_rules_read_from_file
* ini_rules_check
* ini_rules_destroy
* ini_errobj_*
== Note for distribution packagers ==
* API and ABI is backward compatible with last release (0.5.0)
== Detailed Changelog ==
Dmitri Pal (1):
* ini: Add INI_PARSE_IGNORE_NON_KVP flag
Lukas Slebodnik (6):
* INI: Enable string format check for ini_errobj_add_msg
* INI: Extend validator unit test for corner cases
* INI: Reduce count of argumets for ini_rules_check
* INI: Prepare for schema validation
* Bump version-info
* Update versions before 0.6.0 release
Michal Židek (6):
* ini_parse: Add missing TRACE_FLOW_EXIT
* Add unit test for INI_PARSE_IGNORE_NON_KVP
* ini: Add infrastructure for validators
* ini: Add internal validator ini_allowed_options
* tests: Tests for rules/validators infrastructure
* ini: Add internal validator allowed_sections
Robbie Harwood (3):
* Document ini_config_augment alphabetical file processing
* Fix comment in ini_augment_ut.c
* Ensure ding-linbs metapackage depends on libbasicobjects
7 years, 10 months
[ding-libs] [PATCH] ini: Add infrastructure for validators
by Lukas Slebodnik
ehlo,
The first 4 patches are slightly modified version
of Michal's patches. Mostly coding style issues, fixed reports from static
analyzers + fixed small issues which would be fixed as part of review process.
Last two patches are optional improvements which changes ofiginal API.
It was not discussed as part of desing review
but these ideas come to my mind as a part or reading code.
Please review patches.
LS
7 years, 10 months