On Mon, Jun 24, 2013 at 08:04:34AM -0400, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/23/2013 03:12 PM, Jakub Hrozek wrote:
> The attached patch applies on both master and sssd-1-9 and fixes:
>
https://fedorahosted.org/sssd/ticket/1806
>
> The IPA provider attempted to store the original value of member
> attribute to the cache. That caused the memberof plugin to process
> the values which was really CPU intensive.
>
> We don't use the values anywhere and rely on the originalDN
> instead, so it's safe to avoid even downloading them.
>
> Many thanks to Andreas and Simo for their help debugging the
> problem.
>
Nack
I was thinking that we might consider replacing SYSDB_MEMBER with
SYSDB_ORIG_MEMBER (so it gets translated to originalMember instead),
but if we're really not consuming it anywhere at all, I agree that it
makes sense to save bandwidth and storage. So the patch is fine as it
is, except for one thing.
I couldn't find any place where we would read either SYSDB_MEMBER or the
map entry.
As a one-time event, we should also update the DB version and purge
these entries that already exist. The reason for that is that in the
future if we had to re-process the member/memberOf relations in
another update, we don't want to force these to be re-evaluated.
Sorry, I don't understand. Why should we purge the old database? The
member attributes were never saved because they contained the original
values, not the sysdb DN. So ldb just skipped them after attempting to
save them.