[SSSD] Netgroups in SSSD

Dmitri Pal dpal at redhat.com
Wed Sep 8 18:58:17 UTC 2010


Stephen Gallagher wrote:
> On 09/08/2010 02:07 PM, Dmitri Pal wrote:
> > Yes, I agree, though I feel there is a way to do it nicely. I just can't
> > visualize it.
>
> > But...
> > So what will you do if you have two netgroups: A and B. B is a
> member of A.
> > The caller fetched B and then a second before B expires fetched A. Are
> > you going to refetch B or just copy it?
>
> Copy it.
>
> > If you refetch you effectively refetch each time, if you copy you just
> > extended its life.
>
> Yes, you extend the life of the instance of B within A, not B itself.
> What this means is that if netgroup C comes in five seconds later which
> ALSO has B as a member, it will fetch a new copy of B into the memory
> cache.
>
> > So I was thinking that the hash I described would keep a structure. One
> > member is pointer.
> > Another member is time stamp of the original fetch and another is delta.
> > Then we will have two config values: max cache lifetime and min cache
> > lifetime
> > Max cache life time will control if the netgroup needs to be
> > unconditionally refetched - effectively it is the expiration time.
> > min cache life time is the expiration time of the netgroup entry that
> > was not touched.
> > Here is the example:
> > min = 30 sec
> > max = 90 sec
>
> > B is fetched at t = 0
> > A is fetched at t = 20
> > B is not refetched. Instead its life is extended by saving delta = 20.
>
>
> The problem with this approach is that it can result in B never being
> refetched, if A happens to be refreshed for example every 29 seconds. 

This is not the case. If you look at the if statement below you will see
that it is always refreshed after "max" interval but this is a mute
point and I generally agree with your approach.

> By
> copying the data and leaving B alone to refresh itself as needed, we
> guarantee that the worst-case situation is that a sub-entry within an
> unrolled netgroup will stick around twice as long as the timeout, but
> that primary entries will always be refreshed as expected.
>
> > There is another netgroup C that nests B that is fetched at t = X
> > If (X - B_fetch_timestamp) > max  or (X - B_fetch_timestamp - B_delta) >
> > min then refetch B
> > otherwise B_delta = X -B_fetch_timestamp
>
> > But this does not solve the problem of the multiple iterations happening
> > at the same time since you do not want to reconstruct the collection
> > while the iterator is already defined against it  so you still need to
> > make a copy.
> > However using this logic you probably would be able to share more and go
> > to the server less.
> > But again it is an optimization that might not be needed.
>
>

-- 
Thank you,
Dmitri Pal

Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/




More information about the sssd-devel mailing list