we are seeing an issue with newer version of sssd with centos 7.9 sssd version 1.16.5-10.el7_9.5.x86_64, where Initgroups is taking much longer compared to
previous version. Can you please look into it. Following are details, including a sample program to reproduce the issue with old and new version.
Sample Program: get_user_groups.py
- it just call getgrouplist of a user supplied using libc
Old env -
OS Linux 3.10.0-1127.19.1.el7.x86_64 #1 SMP Wed Aug 26 11:48:49 BST 2020 x86_64 x86_64 x86_64 GNU/Linux
SSSD Version - 1.16.4-37.el7_8.4.x86_64
Sample log file - sssd_nss-old.log
Flamegraph - flamgraph_sssd_nss-old.svg
ID 879 'Initgroups by name' testuser1@example
starttime Tue Dec 1 18:36:42:092541 2020
endtime Tue Dec 1 18:36:42:124463 2020
lookup_time 0.031922 sec
New env
OS Linux 3.10.0-1160.6.1.el7.x86_64 #1 SMP Wed Nov 18 22:40:48 GMT 2020 x86_64 x86_64 x86_64 GNU/Linux
SSSD Version - 1.16.5-10.el7_9.5.x86_64
Sample log file - sssd_nss-new.log
Flamegraph - flamgraph_sssd_nss-new.svg
ID 776 'Initgroups by name' testuser1@example
starttime 2020-12-01 17:31:24:328419
endtime 2020-12-01 17:31:24:451778
lookup_time 0.123359 sec
It seem to be due to addtional .1 second taken during following two trace (from sssd_nss-new.log)
(2020-12-01 17:31:24:355458): [nss] [cache_req_done] (0x0400): CR #776: Finished: Success
(2020-12-01 17:31:24:451727): [nss] [sysdb_search_group_by_id] (0x0400): No such entry
(2020-12-01 17:31:24:451757): [nss] [nss_protocol_fill_initgr] (0x0080): Unable to find primary gid [2]: No such file or directory
It may be related to following change, which seems to ref to sysdb_search_group_by_id
nss: use real primary gid if the value is overriden · SSSD/sssd@80e6f71