> Or maybe an option like this in the config would be useful?
>
> ldap_group_list_filter = group1,group2,group3
>
> Is this something that would be a good contribution for sssd? Even if it's just
an undocumented feature? I could have a crack at it.
>
> Cheers,
>
> Tim.
>
>
I'm not sure if artificially trimming the group list is a good idea.
It wouldn't work for everyone and I would be wary of breaking access
control mechanisms.
Noted. And yes I agree this (non-mandatory) config option wouldn't be useful for
everyone, it's just something that fixes my particular problem (reduces ssh login
times from 30 seconds to <5).
I may have to write my own patch and apply it to the SRPM as each official version of SSSD
is released. It won't be supported by Red Hat obviously but my users won't be
complaining about slow login times anymore. So partial win. :)
We've been looking into the RFC2307bis performance recently and
for
environments like yours, where the user is a member of large number of
groups, the biggest bottleneck is that we're looking up the groups the
user is a member of sequentially. There's a ticket #1062 to track making the
lookups parallel, but it's been put to the deffered bucket mainly because
we're trying to spend our resources on integrating with AD at the
winbind provider.
If you'd like to tackle #1062, I'm sure patches will be welcome.
Yowza. I've had a look and to be honest that kind of code update is beyond my skill
level, I'm sure I'd do more damage than good.
But yes the problem is certainly the sequential processing during the group enumeration.
So that ticket would definitely make a difference.
Cheers,
Tim.
This e-mail is sent by Suncorp Group Limited ABN 66 145 290 124 or one of its related
entities "Suncorp".
Suncorp may be contacted at Level 18, 36 Wickham Terrace, Brisbane or on 13 11 55 or at
suncorp.com.au.
The content of this e-mail is the view of the sender or stated author and does not
necessarily reflect the view of Suncorp. The content, including attachments, is a
confidential communication between Suncorp and the intended recipient. If you are not the
intended recipient, any use, interference with, disclosure or copying of this e-mail,
including attachments, is unauthorised and expressly prohibited. If you have received this
e-mail in error please contact the sender immediately and delete the e-mail and any
attachments from your system.