[SSSD] [PATCHES] Fix severe performance problems with initgroups

Dmitri Pal dpal at redhat.com
Wed Jul 28 20:07:22 UTC 2010


Stephen Gallagher wrote:
>
> Users who are a member of one or more groups containing large numbers of
> members end up with unacceptable wait times (or timeouts) performing
> initgroups calls.
>
> Since initgroups calls are always performed on login, this is causing
> unacceptably long login waits.
>
> This is happening because we tried to be too clever with the initgroups
> calls. When a user logs in, we attempt to completely refresh all entries
> associated with all groups the user is a member of. This worked fine in
> our small test environments, but we didn't adequately test this for
> scalability. Our customers are now doing this for us and are not pleased
> with the results.
>
>
> This patch alters the RFC2307 processing to only update the sysdb with
> information about the current user. This means that there is only one
> round-trip to the LDAP server, and also that the sysdb will not need to
> process many user entries all at once.
>
>
> Patch 0001: Add sysdb_attrs_to_list() utility function
> This is a simple utility to grab the values of a particular attributes
> from a sysdb_attrs list.
>
I started looking at this one and got confused.
Why do you need the inner loop?
How "i" is used?
What is the difference between the passed in number of the attributes
and the "num" member of the structure?
If this is not a bug a comment might be helpful to explain what you are
trying to accomplish.


> Patch 0002: Add a utility function to compare two non-ordered lists of
> strings. It stores the first list as keys in a dhash table, then
> attempts to remove all the keys in the second list with dhash_remove().
> If the return value is success, that value was in both, if it's not
> found, then it was only in the second list. The leftover keys at the end
> are returned as the values only in the first list.
>
> Patch 0003: Add sysdb_group_dn_reverse()
> This is a simple utility to just return the rdn name portion of a
> distinguished name.
>
> Patch 0004: Add a utility routine to duplicate a NULL-terminated list of
> strings.
>
> Patch 0005: Add sysdb_update_members function
> This function will take a user, a list of groups that this user
> should be added to and a list of groups the user should be removed
> from and will recursively call sysdb_[add|remove]_group_member
>
> Patch 0006: Clean up initgroups processing for RFC2307
> Instead of recursively updating all users of each group the user
> being queried belongs to, just add or remove membership for the
> requested user.
>
>
> This series of patches will fix
> https://bugzilla.redhat.com/show_bug.cgi?id=617623 and
> https://fedorahosted.org/sssd/ticket/478
>
> This is a blocker for the 1.2.2 bugfix release.
>

-------------------------

_______________________________________________
sssd-devel mailing list
sssd-devel at lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Thank you,
Dmitri Pal

Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/




More information about the sssd-devel mailing list