[SSSD] [PATCH] implement cleanup task

Simo Sorce ssorce at redhat.com
Mon Nov 9 19:20:25 UTC 2009


Ok, so far we have been sort of cheating as we never removed users once
added.

In the last few weeks, part of the work I did with various patches was
in preparation to add this clean-up task in a way that was at least
somewhat efficient and wouldn't keep hammering your ldap server too
much.
The biggest problem is that it is easy to search for users that exist,
but you can't easily ask the ldap server to tell you which users do not
exist anymore.
Some LDAP implementations have a tombstone that we might decide to use
to further optimize this task, but this is not always a given and they
are usually product specific so we needed a generic way first.

The task can be used in 2 ways.
1. with enumerations
2. when enumerations are disabled

The way it work is that is uses the recently added expiration date to
search all entries that have "expired". If you do this right after an
enumeration you normally hit only entries that have not been updated and
therefore most probably entries that need to be deleted.

Once we have a list of entries to check we proceed validating one by one
using a base search and the originalDN stored in the entry.

For cases where enumeration is not used, this basically means a refresh
of the entries that have been retrieved so far.

So when enumerations are enabled we don't actually run an independent
cache_purge task, we just attach a purge_cache operation after the
enumeration completed successfully.
When enumerations are not enabled instead the ldap_purge_cache_timeout
determines how often this task is run.
By default we run this task only once every hour.

Additionally this patch fixes the code to actually remove entries if a
normal lookup call fails, we weren't actually doing that for the ldap
driver case (it was implemented in the proxy backend case).

So here are 2 patches:
0001 add some functions I needed for the task to sysdb and reworks a few
others

0002 the actual cleanup task files.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Refatctor-delete-functions-and-add-a-few.patch
Type: text/x-patch
Size: 37670 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091109/00e96f8f/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-cleanup-task.patch
Type: text/x-patch
Size: 51104 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091109/00e96f8f/attachment-0001.bin>


More information about the sssd-devel mailing list