[SSSD] [PATCH] fix offline detection/enumeration behavior in ldap_id

Stephen Gallagher sgallagh at redhat.com
Thu Oct 22 13:37:54 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/22/2009 09:35 AM, Simo Sorce wrote:
> On Thu, 2009-10-22 at 08:20 -0400, Stephen Gallagher wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 10/21/2009 01:33 AM, Simo Sorce wrote:
>>> I was seeing the ipa backend blocking on start trying to contact the KDC
>>> and when failing not going offline, causing some applications (su -) to
>>> take a looong time to complete as they make many nss calls, and where
>>> waiting the KDC timeout for each call.
>>>
>>> Simo.
>>>
>>>
>>>
>>> _______________________________________________
>>> sssd-devel mailing list
>>> sssd-devel at lists.fedorahosted.org
>>> https://fedorahosted.org/mailman/listinfo/sssd-devel
>>
>> Rather than delaying for two seconds before starting the first
>> enumeration, can we instead add a flag to the be_ctx that denotes when
>> the ID provider is fully initialized, and just test every 500ms for
>> whether it has been set and then do the first enumeration once it is?
> 
> The problem is that providers are now sbus servers and we don't really
> know how many front-ends are going to connect to us.
> 
>> Two seconds might not be sufficient in slow (e.g. overseas) connections.
> 
> Not sure what you are meaning here. We are waiting to make any
> connection to external servers for 2 seconds, to care first about
> internal sbus connections. I think we could check that we are
> successfully connected to the monitor and at least one frontend client
> before firing I guess, but 2 seconds, while dirty is also much easier,
> and does the job of not blocking initial connections (it still does
> nothing to avoid bind operations to block for long times, and yes it
> goes beyond the 5 seconds timeout because when openldap libraries call
> SASL/GSSAPI apparently they can't enforce their timeout).
> The real solution is to find a way to perform bind operation without
> blocking. So I don't want to spend too much time to "fix" one of the
> symptoms, because I want to spend that time to fix the "Real" problem
> instead.
> 
> Simo.
> 

Agreed. Good enough for now.

- -- 
Stephen Gallagher
RHCE 804006346421761

Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkrgYCwACgkQeiVVYja6o6PA6gCfQhijvnpM8tGRWhyuty/tE/I4
8OkAn2KwXmFjeGFkSzuQFvL9Pr+YwLgw
=JD2G
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list