-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Users who are a member of one or more groups containing large numbers of
members end up with unacceptable wait times (or timeouts) performing
initgroups calls.
Since initgroups calls are always performed on login, this is causing
unacceptably long login waits.
This is happening because we tried to be too clever with the initgroups
calls. When a user logs in, we attempt to completely refresh all entries
associated with all groups the user is a member of. This worked fine in
our small test environments, but we didn't adequately test this for
scalability. Our customers are now doing this for us and are not pleased
with the results.
This patch alters the RFC2307 processing to only update the sysdb with
information about the current user. This means that there is only one
round-trip to the LDAP server, and also that the sysdb will not need to
process many user entries all at once.
Patch 0001: Add sysdb_attrs_to_list() utility function
This is a simple utility to grab the values of a particular attributes
from a sysdb_attrs list.
Patch 0002: Add a utility function to compare two non-ordered lists of
strings. It stores the first list as keys in a dhash table, then
attempts to remove all the keys in the second list with dhash_remove().
If the return value is success, that value was in both, if it's not
found, then it was only in the second list. The leftover keys at the end
are returned as the values only in the first list.
Patch 0003: Add sysdb_group_dn_reverse()
This is a simple utility to just return the rdn name portion of a
distinguished name.
Patch 0004: Add a utility routine to duplicate a NULL-terminated list of
strings.
Patch 0005: Add sysdb_update_members function
This function will take a user, a list of groups that this user
should be added to and a list of groups the user should be removed
from and will recursively call sysdb_[add|remove]_group_member
Patch 0006: Clean up initgroups processing for RFC2307
Instead of recursively updating all users of each group the user
being queried belongs to, just add or remove membership for the
requested user.
This series of patches will fix
https://bugzilla.redhat.com/show_bug.cgi?id=617623 and
https://fedorahosted.org/sssd/ticket/478
This is a blocker for the 1.2.2 bugfix release.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkxQhSsACgkQeiVVYja6o6MdoACgrHGdzRmWOqq/aNrL/2w3WOS1
dWsAnihlfn91CdWchy86qbQcbqRxHIUG
=itid
-----END PGP SIGNATURE-----