Hi Simo,
On 08/29/2016 11:47 PM, Sumit Bose wrote:
Then you do a normal user lookup but if there are groups configured in the session_recording section you always do a SSS_DP_INITGROUPS instead of a SSS_DP_USER if the entry is expired. I think here you can add some improvement to reduce the number of SSS_DP_INITGROUPS calls which are more expensive than SSS_DP_USER. User entries in the cache have two timeout values SYSDB_CACHE_EXPIRE and SYSDB_INITGR_EXPIRE. The first is the expiration time for the general user data (name, home directory, shell etc) and is checked during the normal user lookup. The second is the expiration time of the group-membership data. To make sure that SSS_DP_INITGROUPS is only used when needed I would recommend to additionally check if SYSDB_INITGR_EXPIRE is expired and only do a SSS_DP_INITGROUPS in this case and a SSS_DP_USER in all other cases. Currently both timestamps might not differ often but future enhancements to the backends might change this.
I'm looking at this and am getting confused (old news, I know :).
Two cases where I use SSS_DP_INITGROUPS are invocations of check_cache, which has this code:
/* if we have any reply let's check cache validity */ if (res->count > 0) { /* ... */ if (req_type == SSS_DP_INITGROUPS) { cacheExpire = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_INITGR_EXPIRE, 0); } else { cacheExpire = ldb_msg_find_attr_as_uint64(res->msgs[0], SYSDB_CACHE_EXPIRE, 0); } /* ... */ }
It seems to me that it already checks the cache as you suggested. Is that so?
The only other case is in nss_cmd_setpwent_step, which fetches users for getpwent using sss_dp_get_account_send and it doesn't seem that I could/should do anything there. Is that right?
Thank you.
Nick