[SSSD] failover reconnections

Simo Sorce ssorce at redhat.com
Fri Apr 30 14:58:49 UTC 2010


On Fri, 30 Apr 2010 11:49:57 +0400
Eugene Indenbom <eindenbom at gmail.com> wrote:

> > Hopefully we can avoid "expiring" connections (see premise above),
> > but I think we need to be even more aggressive, and close
> > connections when they go idle. This way we can free server
> > resources and in most cases we will close much before we even get
> > close to expiration time.
> >
> >      
> That's really does not sound as a good idea for me:
> - A full connection cycle takes up to 1 sec, causing huge delays on 
> first response

Well this happens only after a long idle period, I don't think it is
such a bad thing. Also remember that in many cases we will run
operations as side refreshes (when midway cache refreshes are enabled),
so the client will not actually hang as it will get back cached
information.

> - It might make sense to drop cached connection only after at least
> an hour of idle time

I was thinking more around 10/15 min. but this should be a tunable
option with good defaults and the ability to set it to 0 meaning no
idle drops.

> - If we do drop cached connection we should optimize kerberos auth
> not to run ldap_child until cached ticket expire. This would reduce
> initial latency tenfold.

ACK.

> - I do not see a big load on LDAP server if every workstation would
> keep a single LDAP connection. The default configuration of 389-ds
> would handle 8000 workstations. Looks quite enough.

389-ds does, but not all ldap servers may be so happy :)

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list