Hello sssd-users,
I'm experiencing severe performance degradation with SSSD when using
ldap_schema=rfc2307bis. User lookups with "id" can take several seconds,
and I believe that I have identified the root cause.
## Symptoms:
- SSSD logs: "LDAP operation ... seems slow, took more than 80% of timeout"
- OpenLDAP logs: "deferring operation: pending operations"
- Simple "id username" commands taking 5-10+ seconds (when not cached)
## Root Cause:
When looking up a single user, SSSD appears to be sending individual
LDAP queries for EVERY member of EVERY group the user belongs to. This
results in thousands of near-simultaneous asynchronous LDAP searches.
OpenLDAP's conn_max_pending/conn_max_pending_auth parameters are
correctly throttling these requests, causing the perceived slowness.
## Environment:
- SSSD version: 2.9.6
- OpenLDAP version: 2.5.20
## Questions:
1. Why does SSSD need to resolve all group members when looking up a
single user? This should be unnecessary to id a single user.
2. Can SSSD be configured to return just the group names/GIDs for a user
lookup without also fetching full details of every member in those groups?
3. Could SSSD batch these queries or use more efficient LDAP operations?
I've attached my sssd.conf. The key setting is ldap_schema=rfc2307bis.
This behavior effectively makes rfc2307bis unusable in environments with
large groups. Any guidance would be appreciated.
Many thanks,
--
Chris Paul | Rex Consulting |https://www.rexconsulting.net