On 08/15/2014 01:18 AM, Jacob Weber wrote:
> Can you file a RFE?
Sure:
https://fedorahosted.org/sssd/ticket/2408
> Could you check in the logs what takes the longest during the whole
> request? If your server is really fast, maybe you can add
> debug_microseconds to the config file to increase the resolution..
I tried, but I'm not seeing a particular area that's slower than others. I can
try looking more carefully when I have some time.
The lookup doesn't make a huge difference in one request, but it adds up.
In particular, this machine runs Subversion over Apache, and authenticates against the
system users (using SSSD). Unfortunately SVN over Apache makes a ton of separate requests.
Since SSSD doesn't cache, I'm probably going to look into having Apache use a
method that does, like mod_ldap.
> Maybe the new option could cover both the initgroups and authentication,
> not sure. It's a bit of slippery slope, because on a Linux system
> authentication is actually the only moment where groups are set. On the
> other hand, group membership don't change that often..
Plus, if you're doing offline caching, you're already going down that slope...
Jacob
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Is this just authentication?
Because if it is you might consider things like SSO.
Kerberos for example.
While mod_auth_kerb would do the renegotiation on every request which
most likely be a bit slow the new module mod_auth_gssapi has session
support that sets cookies after the initial negotiation. That should be
much faster and I expect it to need your requirement.
Have you considered this as an alternative?
If you need more details of how that all works let me know.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.