[SSSD] [PATCH] Add ldap_search_enumeration_timeout config option

Sumit Bose sbose at redhat.com
Wed Jan 12 13:27:01 UTC 2011


Hi,

these two patches add a feature we already had in 1.2 but missed to part
forward, different timeouts for single user/group searches and
enumerations.

The first patch refactors the current code so that different timeout can
be send to the generic search routine sdap_get_generic_send(). The
second patch add the new option ldap_enumeration_search_timeout, which
defaults to 60s, and sets the default for ldap_search_timeout to 6s. The
new timeout is used by user and group enumerations and by the IPA access
provider to load services, HBAC rules etc.

Hopefully this patch will fix some of the reported delays when working
without connection to the LDAP server or after suspend/resume.

bye,
Sumit
-------------- next part --------------
From b511b124aa0ef67bb47c37bcb64bf814b881e0ca Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 12 Jan 2011 11:31:24 +0100
Subject: [PATCH 1/2] Add timeout parameter to sdap_get_generic_send()

---
 src/providers/ipa/ipa_access.c            |   53 +++++++++++++++++------------
 src/providers/ipa/ipa_auth.c              |    4 ++-
 src/providers/ldap/ldap_id.c              |    8 +++-
 src/providers/ldap/ldap_id_enum.c         |    8 +++-
 src/providers/ldap/ldap_id_netgroup.c     |    5 ++-
 src/providers/ldap/sdap_access.c          |    4 ++-
 src/providers/ldap/sdap_async.c           |   11 +++---
 src/providers/ldap/sdap_async.h           |   12 ++++--
 src/providers/ldap/sdap_async_accounts.c  |   52 ++++++++++++++++++++--------
 src/providers/ldap/sdap_async_netgroups.c |    9 +++--
 10 files changed, 111 insertions(+), 55 deletions(-)

diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c
index c66bb9c..61caef1 100644
--- a/src/providers/ipa/ipa_access.c
+++ b/src/providers/ipa/ipa_access.c
@@ -535,14 +535,17 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx,
         goto fail;
     }
     subreq = sdap_get_generic_send(state,
-                                   hbac_ctx_ev(state->hbac_ctx),
-                                   hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts,
-                                   sdap_handle,
-                                   state->services_search_base,
-                                   LDAP_SCOPE_SUB,
-                                   state->services_filter,
-                                   state->services_attrs,
-                                   NULL, 0);
+                        hbac_ctx_ev(state->hbac_ctx),
+                        hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts,
+                        sdap_handle,
+                        state->services_search_base,
+                        LDAP_SCOPE_SUB,
+                        state->services_filter,
+                        state->services_attrs,
+                        NULL, 0,
+                        dp_opt_get_int(
+                             hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts->basic,
+                             SDAP_SEARCH_TIMEOUT));
 
     if (subreq == NULL) {
         DEBUG(1, ("sdap_get_generic_send failed.\n"));
@@ -830,13 +833,16 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
         goto fail;
     }
     subreq = sdap_get_generic_send(state, hbac_ctx_ev(state->hbac_ctx),
-                                   hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts,
-                                   sdap_handle,
-                                   state->host_search_base,
-                                   LDAP_SCOPE_SUB,
-                                   state->host_filter,
-                                   state->host_attrs,
-                                   NULL, 0);
+                        hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts,
+                        sdap_handle,
+                        state->host_search_base,
+                        LDAP_SCOPE_SUB,
+                        state->host_filter,
+                        state->host_attrs,
+                        NULL, 0,
+                        dp_opt_get_int(
+                             hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts->basic,
+                             SDAP_SEARCH_TIMEOUT));
 
     if (subreq == NULL) {
         DEBUG(1, ("sdap_get_generic_send failed.\n"));
@@ -1148,13 +1154,16 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
         goto fail;
     }
     subreq = sdap_get_generic_send(state, hbac_ctx_ev(state->hbac_ctx),
-                                   hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts,
-                                   sdap_handle,
-                                   state->hbac_search_base,
-                                   LDAP_SCOPE_SUB,
-                                   state->hbac_filter,
-                                   state->hbac_attrs,
-                                   NULL, 0);
+                        hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts,
+                        sdap_handle,
+                        state->hbac_search_base,
+                        LDAP_SCOPE_SUB,
+                        state->hbac_filter,
+                        state->hbac_attrs,
+                        NULL, 0,
+                        dp_opt_get_int(
+                             hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts->basic,
+                             SDAP_SEARCH_TIMEOUT));
 
     if (subreq == NULL) {
         DEBUG(1, ("sdap_get_generic_send failed.\n"));
diff --git a/src/providers/ipa/ipa_auth.c b/src/providers/ipa/ipa_auth.c
index 020b63f..eb7f291 100644
--- a/src/providers/ipa/ipa_auth.c
+++ b/src/providers/ipa/ipa_auth.c
@@ -153,7 +153,9 @@ static void get_password_migration_flag_auth_done(struct tevent_req *subreq)
 
     subreq = sdap_get_generic_send(state, state->ev, state->sdap_auth_ctx->opts,
                                    state->sh, search_base, LDAP_SCOPE_SUBTREE,
-                                   IPA_CONFIG_FILTER, attrs, NULL, 0);
+                                   IPA_CONFIG_FILTER, attrs, NULL, 0,
+                                   dp_opt_get_int(state->sdap_auth_ctx->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         tevent_req_error(req, ENOMEM);
         return;
diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
index ce94731..ed27620 100644
--- a/src/providers/ldap/ldap_id.c
+++ b/src/providers/ldap/ldap_id.c
@@ -169,7 +169,9 @@ static void users_get_connect_done(struct tevent_req *subreq)
                                  state->domain, state->sysdb,
                                  state->ctx->opts,
                                  sdap_id_op_handle(state->op),
-                                 state->attrs, state->filter);
+                                 state->attrs, state->filter,
+                                 dp_opt_get_int(state->ctx->opts->basic,
+                                                SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         tevent_req_error(req, ENOMEM);
         return;
@@ -398,7 +400,9 @@ static void groups_get_connect_done(struct tevent_req *subreq)
     subreq = sdap_get_groups_send(state, state->ev,
                                   state->domain, state->sysdb,
                                   state->ctx->opts, sdap_id_op_handle(state->op),
-                                  state->attrs, state->filter);
+                                  state->attrs, state->filter,
+                                  dp_opt_get_int(state->ctx->opts->basic,
+                                                 SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         tevent_req_error(req, ENOMEM);
         return;
diff --git a/src/providers/ldap/ldap_id_enum.c b/src/providers/ldap/ldap_id_enum.c
index 8695f35..3335f70 100644
--- a/src/providers/ldap/ldap_id_enum.c
+++ b/src/providers/ldap/ldap_id_enum.c
@@ -471,7 +471,9 @@ static struct tevent_req *enum_users_send(TALLOC_CTX *memctx,
                                  state->ctx->be->sysdb,
                                  state->ctx->opts,
                                  sdap_id_op_handle(state->op),
-                                 state->attrs, state->filter);
+                                 state->attrs, state->filter,
+                                 dp_opt_get_int(state->ctx->opts->basic,
+                                                SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         ret = ENOMEM;
         goto fail;
@@ -573,7 +575,9 @@ static struct tevent_req *enum_groups_send(TALLOC_CTX *memctx,
                                  state->ctx->be->domain,
                                  state->ctx->be->sysdb,
                                  state->ctx->opts, sdap_id_op_handle(state->op),
-                                 state->attrs, state->filter);
+                                 state->attrs, state->filter,
+                                 dp_opt_get_int(state->ctx->opts->basic,
+                                                SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         ret = ENOMEM;
         goto fail;
diff --git a/src/providers/ldap/ldap_id_netgroup.c b/src/providers/ldap/ldap_id_netgroup.c
index 6a668a1..72f8e79 100644
--- a/src/providers/ldap/ldap_id_netgroup.c
+++ b/src/providers/ldap/ldap_id_netgroup.c
@@ -38,6 +38,7 @@ struct netgroup_get_state {
     struct sss_domain_info *domain;
 
     const char *name;
+    int timeout;
 
     char *filter;
     const char **attrs;
@@ -79,6 +80,7 @@ struct tevent_req *netgroup_get_send(TALLOC_CTX *memctx,
     state->sysdb = ctx->be->sysdb;
     state->domain = state->ctx->be->domain;
     state->name = name;
+    state->timeout = dp_opt_get_int(ctx->opts->basic, SDAP_SEARCH_TIMEOUT);
 
     ret = sss_filter_sanitize(state, name, &clean_name);
     if (ret != EOK) {
@@ -151,7 +153,8 @@ static void netgroup_get_connect_done(struct tevent_req *subreq)
                                      state->domain, state->sysdb,
                                      state->ctx->opts,
                                      sdap_id_op_handle(state->op),
-                                     state->attrs, state->filter);
+                                     state->attrs, state->filter,
+                                     state->timeout);
     if (!subreq) {
         tevent_req_error(req, ENOMEM);
         return;
diff --git a/src/providers/ldap/sdap_access.c b/src/providers/ldap/sdap_access.c
index ce2d535..df433b6 100644
--- a/src/providers/ldap/sdap_access.c
+++ b/src/providers/ldap/sdap_access.c
@@ -625,7 +625,9 @@ static void sdap_access_filter_connect_done(struct tevent_req *subreq)
                                    state->basedn,
                                    LDAP_SCOPE_BASE,
                                    state->filter, NULL,
-                                   NULL, 0);
+                                   NULL, 0,
+                                   dp_opt_get_int(state->sdap_ctx->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (subreq == NULL) {
         DEBUG(1, ("Could not start LDAP communication\n"));
         state->pam_status = PAM_SYSTEM_ERR;
diff --git a/src/providers/ldap/sdap_async.c b/src/providers/ldap/sdap_async.c
index 6929b29..134f397 100644
--- a/src/providers/ldap/sdap_async.c
+++ b/src/providers/ldap/sdap_async.c
@@ -671,7 +671,9 @@ struct tevent_req *sdap_get_rootdse_send(TALLOC_CTX *memctx,
 
     subreq = sdap_get_generic_send(state, ev, opts, sh,
                                    "", LDAP_SCOPE_BASE,
-                                   "(objectclass=*)", attrs, NULL, 0);
+                                   "(objectclass=*)", attrs, NULL, 0,
+                                   dp_opt_get_int(state->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         talloc_zfree(req);
         return NULL;
@@ -770,7 +772,8 @@ struct tevent_req *sdap_get_generic_send(TALLOC_CTX *memctx,
                                          const char *filter,
                                          const char **attrs,
                                          struct sdap_attr_map *map,
-                                         int map_num_attrs)
+                                         int map_num_attrs,
+                                         int timeout)
 {
     struct tevent_req *req = NULL;
     struct sdap_get_generic_state *state = NULL;
@@ -839,9 +842,7 @@ struct tevent_req *sdap_get_generic_send(TALLOC_CTX *memctx,
     DEBUG(8, ("ldap_search_ext called, msgid = %d\n", msgid));
 
     ret = sdap_op_add(state, state->ev, state->sh, msgid,
-                      sdap_get_generic_done, req,
-                      dp_opt_get_int(state->opts->basic,
-                                     SDAP_SEARCH_TIMEOUT),
+                      sdap_get_generic_done, req, timeout,
                       &state->op);
     if (ret != EOK) {
         DEBUG(1, ("Failed to set up operation!\n"));
diff --git a/src/providers/ldap/sdap_async.h b/src/providers/ldap/sdap_async.h
index 10d0c30..5e37714 100644
--- a/src/providers/ldap/sdap_async.h
+++ b/src/providers/ldap/sdap_async.h
@@ -44,7 +44,8 @@ struct tevent_req *sdap_get_users_send(TALLOC_CTX *memctx,
                                        struct sdap_options *opts,
                                        struct sdap_handle *sh,
                                        const char **attrs,
-                                       const char *wildcard);
+                                       const char *wildcard,
+                                       int timeout);
 int sdap_get_users_recv(struct tevent_req *req,
                         TALLOC_CTX *mem_ctx, char **timestamp);
 
@@ -55,7 +56,8 @@ struct tevent_req *sdap_get_groups_send(TALLOC_CTX *memctx,
                                        struct sdap_options *opts,
                                        struct sdap_handle *sh,
                                        const char **attrs,
-                                       const char *wildcard);
+                                       const char *wildcard,
+                                       int timeout);
 int sdap_get_groups_recv(struct tevent_req *req,
                          TALLOC_CTX *mem_ctx, char **timestamp);
 
@@ -66,7 +68,8 @@ struct tevent_req *sdap_get_netgroups_send(TALLOC_CTX *memctx,
                                            struct sdap_options *opts,
                                            struct sdap_handle *sh,
                                            const char **attrs,
-                                           const char *wildcard);
+                                           const char *wildcard,
+                                           int timeout);
 int sdap_get_netgroups_recv(struct tevent_req *req,
                             TALLOC_CTX *mem_ctx, char **timestamp,
                             size_t *reply_count,
@@ -142,7 +145,8 @@ struct tevent_req *sdap_get_generic_send(TALLOC_CTX *memctx,
                                          const char *filter,
                                          const char **attrs,
                                          struct sdap_attr_map *map,
-                                         int map_num_attrs);
+                                         int map_num_attrs,
+                                         int timeout);
 int sdap_get_generic_recv(struct tevent_req *req,
                          TALLOC_CTX *mem_ctx, size_t *reply_count,
                          struct sysdb_attrs ***reply_list);
diff --git a/src/providers/ldap/sdap_async_accounts.c b/src/providers/ldap/sdap_async_accounts.c
index 289b637..b853563 100644
--- a/src/providers/ldap/sdap_async_accounts.c
+++ b/src/providers/ldap/sdap_async_accounts.c
@@ -385,7 +385,8 @@ struct tevent_req *sdap_get_users_send(TALLOC_CTX *memctx,
                                        struct sdap_options *opts,
                                        struct sdap_handle *sh,
                                        const char **attrs,
-                                       const char *filter)
+                                       const char *filter,
+                                       int timeout)
 {
     struct tevent_req *req, *subreq;
     struct sdap_get_users_state *state;
@@ -409,7 +410,8 @@ struct tevent_req *sdap_get_users_send(TALLOC_CTX *memctx,
                                                      SDAP_USER_SEARCH_BASE),
                                    LDAP_SCOPE_SUBTREE,
                                    state->filter, state->attrs,
-                                   state->opts->user_map, SDAP_OPTS_USER);
+                                   state->opts->user_map, SDAP_OPTS_USER,
+                                   timeout);
     if (!subreq) {
         talloc_zfree(req);
         return NULL;
@@ -1271,7 +1273,9 @@ sdap_process_missing_member_2307bis(struct tevent_req *req,
                                        grp_state->filter,
                                        grp_state->attrs,
                                        grp_state->opts->user_map,
-                                       SDAP_OPTS_USER);
+                                       SDAP_OPTS_USER,
+                                       dp_opt_get_int(grp_state->opts->basic,
+                                                      SDAP_SEARCH_TIMEOUT));
         if (!subreq) {
             return ENOMEM;
         }
@@ -1418,7 +1422,9 @@ next:
                                        state->filter,
                                        state->attrs,
                                        state->opts->user_map,
-                                       SDAP_OPTS_USER);
+                                       SDAP_OPTS_USER,
+                                       dp_opt_get_int(state->opts->basic,
+                                                      SDAP_SEARCH_TIMEOUT));
         if (!subreq) {
             tevent_req_error(req, ENOMEM);
             return;
@@ -1489,7 +1495,8 @@ struct tevent_req *sdap_get_groups_send(TALLOC_CTX *memctx,
                                        struct sdap_options *opts,
                                        struct sdap_handle *sh,
                                        const char **attrs,
-                                       const char *filter)
+                                       const char *filter,
+                                       int timeout)
 {
     struct tevent_req *req, *subreq;
     struct sdap_get_groups_state *state;
@@ -1513,7 +1520,8 @@ struct tevent_req *sdap_get_groups_send(TALLOC_CTX *memctx,
                                                      SDAP_GROUP_SEARCH_BASE),
                                    LDAP_SCOPE_SUBTREE,
                                    state->filter, state->attrs,
-                                   state->opts->group_map, SDAP_OPTS_GROUP);
+                                   state->opts->group_map, SDAP_OPTS_GROUP,
+                                   timeout);
     if (!subreq) {
         talloc_zfree(req);
         return NULL;
@@ -1940,7 +1948,9 @@ struct tevent_req *sdap_initgr_rfc2307_send(TALLOC_CTX *memctx,
     subreq = sdap_get_generic_send(state, state->ev, state->opts,
                                    state->sh, base_dn, LDAP_SCOPE_SUBTREE,
                                    filter, attrs,
-                                   state->opts->group_map, SDAP_OPTS_GROUP);
+                                   state->opts->group_map, SDAP_OPTS_GROUP,
+                                   dp_opt_get_int(state->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         talloc_zfree(req);
         return NULL;
@@ -2177,7 +2187,9 @@ static struct tevent_req *sdap_initgr_nested_send(TALLOC_CTX *memctx,
                                    state->group_dns[state->cur],
                                    LDAP_SCOPE_BASE,
                                    state->filter, state->grp_attrs,
-                                   state->opts->group_map, SDAP_OPTS_GROUP);
+                                   state->opts->group_map, SDAP_OPTS_GROUP,
+                                   dp_opt_get_int(state->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         talloc_zfree(req);
         return NULL;
@@ -2221,7 +2233,9 @@ static void sdap_initgr_nested_search(struct tevent_req *subreq)
                                        LDAP_SCOPE_BASE,
                                        state->filter, state->grp_attrs,
                                        state->opts->group_map,
-                                       SDAP_OPTS_GROUP);
+                                       SDAP_OPTS_GROUP,
+                                       dp_opt_get_int(state->opts->basic,
+                                                      SDAP_SEARCH_TIMEOUT));
         if (!subreq) {
             tevent_req_error(req, ENOMEM);
             return;
@@ -2331,7 +2345,9 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
                                    state->opts, state->sh,
                                    base_dn, LDAP_SCOPE_SUBTREE,
                                    filter, attrs,
-                                   state->opts->user_map, SDAP_OPTS_USER);
+                                   state->opts->user_map, SDAP_OPTS_USER,
+                                   dp_opt_get_int(state->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         talloc_zfree(req);
         return NULL;
@@ -2840,7 +2856,9 @@ static errno_t sdap_nested_group_lookup_user(struct tevent_req *req,
                                    LDAP_SCOPE_BASE,
                                    filter, sdap_attrs,
                                    state->opts->user_map,
-                                   SDAP_OPTS_USER);
+                                   SDAP_OPTS_USER,
+                                   dp_opt_get_int(state->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         talloc_free(sdap_attrs);
         return EIO;
@@ -2880,7 +2898,9 @@ static errno_t sdap_nested_group_lookup_group(struct tevent_req *req)
                                    LDAP_SCOPE_BASE,
                                    filter, sdap_attrs,
                                    state->opts->group_map,
-                                   SDAP_OPTS_GROUP);
+                                   SDAP_OPTS_GROUP,
+                                   dp_opt_get_int(state->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         talloc_free(sdap_attrs);
         return EIO;
@@ -3212,7 +3232,9 @@ static struct tevent_req *sdap_initgr_rfc2307bis_send(
     subreq = sdap_get_generic_send(state, state->ev, state->opts,
                                    state->sh, base_dn, LDAP_SCOPE_SUBTREE,
                                    filter, attrs,
-                                   state->opts->group_map, SDAP_OPTS_GROUP);
+                                   state->opts->group_map, SDAP_OPTS_GROUP,
+                                   dp_opt_get_int(state->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         talloc_zfree(req);
         return NULL;
@@ -3610,7 +3632,9 @@ static errno_t rfc2307bis_nested_groups_step(struct tevent_req *req)
                                                      SDAP_GROUP_SEARCH_BASE),
                                    LDAP_SCOPE_SUBTREE,
                                    filter, attrs,
-                                   state->opts->group_map, SDAP_OPTS_GROUP);
+                                   state->opts->group_map, SDAP_OPTS_GROUP,
+                                   dp_opt_get_int(state->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         ret = EIO;
         goto error;
diff --git a/src/providers/ldap/sdap_async_netgroups.c b/src/providers/ldap/sdap_async_netgroups.c
index 0184548..1f6c6d0 100644
--- a/src/providers/ldap/sdap_async_netgroups.c
+++ b/src/providers/ldap/sdap_async_netgroups.c
@@ -467,7 +467,9 @@ static errno_t netgr_translate_members_ldap_step(struct tevent_req *req)
     subreq = sdap_get_generic_send(state, state->ev, state->opts, state->sh,
                                    state->dn_item->dn, LDAP_SCOPE_BASE, NULL,
                                    cn_attr, state->opts->netgroup_map,
-                                   SDAP_OPTS_NETGROUP);
+                                   SDAP_OPTS_NETGROUP,
+                                   dp_opt_get_int(state->opts->basic,
+                                                  SDAP_SEARCH_TIMEOUT));
     if (!subreq) {
         DEBUG(1, ("sdap_get_generic_send failed.\n"));
         return ENOMEM;
@@ -582,7 +584,8 @@ struct tevent_req *sdap_get_netgroups_send(TALLOC_CTX *memctx,
                                            struct sdap_options *opts,
                                            struct sdap_handle *sh,
                                            const char **attrs,
-                                           const char *filter)
+                                           const char *filter,
+                                           int timeout)
 {
     struct tevent_req *req, *subreq;
     struct sdap_get_netgroups_state *state;
@@ -607,7 +610,7 @@ struct tevent_req *sdap_get_netgroups_send(TALLOC_CTX *memctx,
                                    LDAP_SCOPE_SUBTREE,
                                    state->filter, state->attrs,
                                    state->opts->netgroup_map,
-                                   SDAP_OPTS_NETGROUP);
+                                   SDAP_OPTS_NETGROUP, timeout);
     if (!subreq) {
         talloc_zfree(req);
         return NULL;
-- 
1.7.3.3

-------------- next part --------------
From 00ed38b57d68e82458fd4469208b50b84476d51f Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 12 Jan 2011 11:32:42 +0100
Subject: [PATCH 2/2] Add ldap_search_enumeration_timeout config option

---
 src/config/SSSDConfig.py                 |    1 +
 src/config/etc/sssd.api.d/sssd-ldap.conf |    1 +
 src/man/sssd-ldap.5.xml                  |   28 +++++++++++++++++++++++-----
 src/providers/ipa/ipa_access.c           |    6 +++---
 src/providers/ipa/ipa_common.c           |    5 +++--
 src/providers/ipa/ipa_common.h           |    2 +-
 src/providers/ldap/ldap_common.c         |    5 +++--
 src/providers/ldap/ldap_id_enum.c        |    4 ++--
 src/providers/ldap/sdap.h                |    1 +
 9 files changed, 38 insertions(+), 15 deletions(-)

diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index d23641c..b3861a5 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -140,6 +140,7 @@ option_strings = {
 
     # [provider/ldap/id]
     'ldap_search_timeout' : _('Length of time to wait for a search request'),
+    'ldap_enumeration_search_timeout' : _('Length of time to wait for a enumeration request'),
     'ldap_enumeration_refresh_timeout' : _('Length of time between enumeration updates'),
     'ldap_purge_cache_timeout' : _('Length of time between cache cleanups'),
     'ldap_id_use_start_tls' : _('Require TLS for ID lookups'),
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index c2179f2..8aaecd5 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -27,6 +27,7 @@ ldap_deref = str, None, false
 
 [provider/ldap/id]
 ldap_search_timeout = int, None, false
+ldap_enumeration_search_timeout = int, None, false
 ldap_enumeration_refresh_timeout = int, None, false
 ldap_purge_cache_timeout = int, None, false
 ldap_id_use_start_tls = bool, None, true, false
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 7a73346..175ec35 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -718,14 +718,32 @@
                     <term>ldap_search_timeout (integer)</term>
                     <listitem>
                         <para>
-                            Specifies the timeout (in seconds) that ldap searches
+                            Specifies the timeout (in seconds) that ldap
+                            searches are allowed to run before they are
+                            cancelled and cached results are returned (and
+                            offline mode is entered)
+                        </para>
+                        <para>
+                            Note: this option is subject to change in future
+                            versions of the SSSD. It will likely be replaced at
+                            some point by a series of timeouts for specific
+                            lookup types.
+                        </para>
+                        <para>
+                            Default: 6
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_enumeration_search_timeout (integer)</term>
+                    <listitem>
+                        <para>
+                            Specifies the timeout (in seconds) that ldap
+                            searches for user and group enumerations
                             are allowed to run before they are cancelled and
                             cached results are returned (and offline mode is
                             entered)
-
-                            Note: this option is subject to change in future versions
-                            of the SSSD. It will likely be replaced at some point by
-                            a series of timeouts for specific lookup types.
                         </para>
                         <para>
                             Default: 60
diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c
index 61caef1..feddc87 100644
--- a/src/providers/ipa/ipa_access.c
+++ b/src/providers/ipa/ipa_access.c
@@ -545,7 +545,7 @@ struct tevent_req *hbac_get_service_data_send(TALLOC_CTX *memctx,
                         NULL, 0,
                         dp_opt_get_int(
                              hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts->basic,
-                             SDAP_SEARCH_TIMEOUT));
+                             SDAP_ENUM_SEARCH_TIMEOUT));
 
     if (subreq == NULL) {
         DEBUG(1, ("sdap_get_generic_send failed.\n"));
@@ -842,7 +842,7 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
                         NULL, 0,
                         dp_opt_get_int(
                              hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts->basic,
-                             SDAP_SEARCH_TIMEOUT));
+                             SDAP_ENUM_SEARCH_TIMEOUT));
 
     if (subreq == NULL) {
         DEBUG(1, ("sdap_get_generic_send failed.\n"));
@@ -1163,7 +1163,7 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
                         NULL, 0,
                         dp_opt_get_int(
                              hbac_ctx_sdap_id_ctx(state->hbac_ctx)->opts->basic,
-                             SDAP_SEARCH_TIMEOUT));
+                             SDAP_ENUM_SEARCH_TIMEOUT));
 
     if (subreq == NULL) {
         DEBUG(1, ("sdap_get_generic_send failed.\n"));
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index a42cc3b..4c96bab 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -43,7 +43,7 @@ struct dp_option ipa_def_ldap_opts[] = {
     { "ldap_default_bind_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_default_authtok_type", DP_OPT_STRING, NULL_STRING, NULL_STRING},
     { "ldap_default_authtok", DP_OPT_BLOB, NULL_BLOB, NULL_BLOB },
-    { "ldap_search_timeout", DP_OPT_NUMBER, { .number = 60 }, NULL_NUMBER },
+    { "ldap_search_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
     { "ldap_network_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
     { "ldap_opt_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
     { "ldap_tls_reqcert", DP_OPT_STRING, { "hard" }, NULL_STRING },
@@ -81,7 +81,8 @@ struct dp_option ipa_def_ldap_opts[] = {
     { "ldap_account_expire_policy", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_access_order", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_chpass_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
-    { "ldap_chpass_dns_service_name", DP_OPT_STRING, NULL_STRING, NULL_STRING }
+    { "ldap_chpass_dns_service_name", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_enumeration_search_timeout", DP_OPT_NUMBER, { .number = 60 }, NULL_NUMBER }
 };
 
 struct sdap_attr_map ipa_attr_map[] = {
diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h
index 4d79c03..49618f0 100644
--- a/src/providers/ipa/ipa_common.h
+++ b/src/providers/ipa/ipa_common.h
@@ -35,7 +35,7 @@ struct ipa_service {
 /* the following defines are used to keep track of the options in the ldap
  * module, so that if they change and ipa is not updated correspondingly
  * this will trigger a runtime abort error */
-#define IPA_OPTS_BASIC_TEST 43
+#define IPA_OPTS_BASIC_TEST 44
 
 /* the following define is used to keep track of the options in the krb5
  * module, so that if they change and ipa is not updated correspondingly
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index c98dd4f..6daf2c9 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -39,7 +39,7 @@ struct dp_option default_basic_opts[] = {
     { "ldap_default_bind_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_default_authtok_type", DP_OPT_STRING, NULL_STRING, NULL_STRING},
     { "ldap_default_authtok", DP_OPT_BLOB, NULL_BLOB, NULL_BLOB },
-    { "ldap_search_timeout", DP_OPT_NUMBER, { .number = 60 }, NULL_NUMBER },
+    { "ldap_search_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
     { "ldap_network_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
     { "ldap_opt_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
     { "ldap_tls_reqcert", DP_OPT_STRING, { "hard" }, NULL_STRING },
@@ -77,7 +77,8 @@ struct dp_option default_basic_opts[] = {
     { "ldap_account_expire_policy", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_access_order", DP_OPT_STRING, { "filter" }, NULL_STRING },
     { "ldap_chpass_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
-    { "ldap_chpass_dns_service_name", DP_OPT_STRING, NULL_STRING, NULL_STRING }
+    { "ldap_chpass_dns_service_name", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "ldap_enumeration_search_timeout", DP_OPT_NUMBER, { .number = 60 }, NULL_NUMBER }
 };
 
 struct sdap_attr_map generic_attr_map[] = {
diff --git a/src/providers/ldap/ldap_id_enum.c b/src/providers/ldap/ldap_id_enum.c
index 3335f70..f47ee9f 100644
--- a/src/providers/ldap/ldap_id_enum.c
+++ b/src/providers/ldap/ldap_id_enum.c
@@ -473,7 +473,7 @@ static struct tevent_req *enum_users_send(TALLOC_CTX *memctx,
                                  sdap_id_op_handle(state->op),
                                  state->attrs, state->filter,
                                  dp_opt_get_int(state->ctx->opts->basic,
-                                                SDAP_SEARCH_TIMEOUT));
+                                                SDAP_ENUM_SEARCH_TIMEOUT));
     if (!subreq) {
         ret = ENOMEM;
         goto fail;
@@ -577,7 +577,7 @@ static struct tevent_req *enum_groups_send(TALLOC_CTX *memctx,
                                  state->ctx->opts, sdap_id_op_handle(state->op),
                                  state->attrs, state->filter,
                                  dp_opt_get_int(state->ctx->opts->basic,
-                                                SDAP_SEARCH_TIMEOUT));
+                                                SDAP_ENUM_SEARCH_TIMEOUT));
     if (!subreq) {
         ret = ENOMEM;
         goto fail;
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 57865fe..9ef9b70 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -191,6 +191,7 @@ enum sdap_basic_opt {
     SDAP_ACCESS_ORDER,
     SDAP_CHPASS_URI,
     SDAP_CHPASS_DNS_SERVICE_NAME,
+    SDAP_ENUM_SEARCH_TIMEOUT,
 
     SDAP_OPTS_BASIC /* opts counter */
 };
-- 
1.7.3.3



More information about the sssd-devel mailing list