[SSSD] a few questions about sssd

Stephen Gallagher sgallagh at redhat.com
Mon Nov 2 12:20:18 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/01/2009 11:44 PM, David O'Brien wrote:
> Greetings one and all. I have a couple of questions about sssd, from 
> various places.
> 
> 1. "How long should nss_sss cache negative cache hits before asking the 
> back end again?" (from NSS config options in the sssd.conf man page)

This describes the negative cache. In order to avoid flooding the data
provider with requests for a user that does not exist, we will maintain
a temporary negative cache that will short-circuit the usual lookup.
Normally the process would be:

1) Is the user in cache? No.
2) Ask the data provider to update the cache.
3) Data provider asks the remote data store about the user. No such
user. (This is an expensive operation, time-wise)
4) Data provider returns without updating the cache.
5) Cache reports no such user.

With this setting, after the first time that the data provider returns
no such user, we add this to a special negative cache (for as long as
this option specifies). This adds an additional step 0 to the above,
which is to check whether the user is in the negative cache first. If it
is, it immediately reports no such user instead of checking the data
provider.

This is useful in cases where someone might mistype a name and then the
process they run attempts to use this name many, many times in a very
short period. Rather than go to the data provider every time (which we
know will always be negative), we use the negative cache.

> 
> I don't quite get how you query the cache for something and cache the 
> results, unless there are two caches.
> 
> 2. Are the cache and other option's values specified in seconds? I've 
> seen values of 15, 120, and 600, but I'm green enough with this sort of 
> thing to ask to make sure.

With one exception, they're all specified in seconds. That exception is
the offline_credentials_expiration, which as the manpage states is
specified in days.

> 
> thanks


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkruznsACgkQeiVVYja6o6Ni0gCcCLPxUrZUToYWTLP45suG35Sq
UkcAnidwcFTldKoVtM1lwBCnWu2mBn1b
=WXH8
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list