On Tue, Jul 26, 2016 at 01:51:56PM +0200, Sumit Bose wrote:
On Mon, Jul 25, 2016 at 01:45:13PM +0200, Jakub Hrozek wrote:
On Thu, Jul 21, 2016 at 02:13:40PM +0200, Sumit Bose wrote:
Hi,
this is my suggestion to solve https://fedorahosted.org/sssd/ticket/2948 "Handle overriden name of members in the memberUid attribute".
So far I read them to get a grasp of what they do, but didn't do a full review. See some comments below.
The first two patches are for the IPA provider and make sure that all ghost members in a group get resolved because otherwise we cannot determine if the name is overridden or not. This adds an overhead to group lookups, especially for larger groups but I think it is an requirement which cannot be skipped.
Right. But I wonder if we could skip it on-demand. Could we maybe check if any views exist in the IPA domain at all and not resolve the members if there are no idview data? I would guess that since this is SSSD on the IPA server, then an additiona LDAP lookup might be cheaper than resolving a full large group.
Yes, that would be possible. But since this is about AD users I would prefer a different change.
Since AD used RFC2307bis (member attribute with the DN of the member) we already read the user object from the AD GC when resolving the group but only ask for objectclass and samAccountName to be able to fill the ghost entry. If we would switch to the LDAP port, read the whole entry and save it to the chance there wouldn't be any ghost entries in the first place. But I wanted to avoid regressions in the common SDAP code at this time so I resolved the ghosts in a second step.
But I guess it is worth to open a ticket to add either or both kinds of optimization.
OK, I hope with the timestamp cache, the performance impact would only be during the first lookup.
Should I open that ticket or would you?