[SSSD] [PATCH] implement cleanup task

Stephen Gallagher sgallagh at redhat.com
Mon Nov 9 20:57:07 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/09/2009 02:20 PM, Simo Sorce wrote:
> Ok, so far we have been sort of cheating as we never removed users once
> added.
> 
> In the last few weeks, part of the work I did with various patches was
> in preparation to add this clean-up task in a way that was at least
> somewhat efficient and wouldn't keep hammering your ldap server too
> much.
> The biggest problem is that it is easy to search for users that exist,
> but you can't easily ask the ldap server to tell you which users do not
> exist anymore.
> Some LDAP implementations have a tombstone that we might decide to use
> to further optimize this task, but this is not always a given and they
> are usually product specific so we needed a generic way first.
> 
> The task can be used in 2 ways.
> 1. with enumerations
> 2. when enumerations are disabled
> 
> The way it work is that is uses the recently added expiration date to
> search all entries that have "expired". If you do this right after an
> enumeration you normally hit only entries that have not been updated and
> therefore most probably entries that need to be deleted.
> 
> Once we have a list of entries to check we proceed validating one by one
> using a base search and the originalDN stored in the entry.
> 
> For cases where enumeration is not used, this basically means a refresh
> of the entries that have been retrieved so far.
> 
> So when enumerations are enabled we don't actually run an independent
> cache_purge task, we just attach a purge_cache operation after the
> enumeration completed successfully.
> When enumerations are not enabled instead the ldap_purge_cache_timeout
> determines how often this task is run.
> By default we run this task only once every hour.
> 
> Additionally this patch fixes the code to actually remove entries if a
> normal lookup call fails, we weren't actually doing that for the ldap
> driver case (it was implemented in the proxy backend case).
> 
> So here are 2 patches:
> 0001 add some functions I needed for the task to sysdb and reworks a few
> others

Nack.
sysdb_delete_user_send() should check whether both name and UID are
specified and fail if they are. Right now, if they are both set, we are
silently only using the name. Similarly, if neither is set (name==NULL
and uid==0) we should fail.

Same comments about sysdb_delete_group_send().

Otherwise it looks fine.

> 
> 0002 the actual cleanup task files.

Nack.

Please update manpages for ldap_purge_cache timeout, as well as the
SSSDConfig API configuration files.

I don't like using SDAP_CACHE_PURGE_TIMEOUT for both the interval
between purge attempts AND the timeout for the purge running. Please add
one second to the interval time. Otherwise we're going to start queuing
up transaction waits on subsequent timeout tries if for some reason the
remote server is being very slow or unresponsive to our requests. Over a
long enough period of time, this could be a genuine resource problem.
I'd much prefer to guarantee that only one such request can be running
at any given time.

The general approach looks fine to me, though I see a lot of duplication
between the cleanup_users_send() and cleanup_groups_send() functions and
I can't help wondering if there's a way that these could be made into a
single set of functions.

Also, can you add a set of tests to the sysdb-tests to manually set some
cache expiration times to "1" and verify that the cleanup task clears
them appropriately. (For regression-detection)

> 
> Simo.
> 
> 
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkr4ghwACgkQeiVVYja6o6PoBACffvollQBm8FE01f9PKH9Funii
NR4AoK/d1uxa3G+DQf639hx8w51wqfHS
=52x/
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list