[SSSD] [PATCH] Split database file to one per domain

Simo Sorce ssorce at redhat.com
Fri Sep 4 22:02:09 UTC 2009


Hello list.

So far we have been using a single database file for all our caches as
well as for the local domain.

Initially I used a single database because I thought we could optimize
some search queries when it came to enumerations. That didn't prove true
and in effect we are doing always separate searches for different
domains (in fact the patch was rather simple to write from this pov as
no searches needed to be touched at all).

Using a single database file for all domains is otherwise a
disadvantage.
>From a pure "security" point of view each backend has now it's own
database and cannot "screw up" other domains data.
Each domain access its backend separately so there is less contention
when you want to start a transaction.
The various files are clearly separated, so you can easily just delete
all the ones named cache-NAME.ldb and not risk deleting the persistent
data in sssd.ldb

The patch includes also upgrade routines to automatically backup and
convert the old file into split files, so switching to the new code is
painless.

All the code was converted to handle the new list of database
structures. One part that felt odd was the sss_tools. They should really
only operate on the 'local' domain and nothing else. So attaches is also
a patch that basically reverts most of the changes and just opens the
'local' database instead. I have not merged them in a single patch
because I didn't want to mix format changes with functional changes and
because apparently we may want to be a bit more radical and eliminate
also the shadow-utils handling at the same time.

I have tested the change and the upgrade as well as starting from
scratch and all seem to work properly.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Split-database-in-multiple-files.patch
Type: text/x-patch
Size: 80893 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20090904/0ef86d1b/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Tools-are-allowed-to-touch-only-the-local-domain.patch
Type: text/x-patch
Size: 12858 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20090904/0ef86d1b/attachment-0001.bin>


More information about the sssd-devel mailing list