[SSSD] Announcing SSSD 1.5.14

Jan Zelený jzeleny at redhat.com
Thu Nov 3 08:31:19 UTC 2011


> Hi all.  Thanks to everyone for their help so far.
> 
> OK, I've been diving into the code today.  v1.5.15 tho since it just got
> released.
> 
> > (Thu Oct 27 10:17:13 2011) [sssd[be[XXX.XXX.XXX]]]
> > [sdap_get_generic_step] (6): calling ldap_search_ext with 
> > [(&(msSFU30PosixMember=CN=U999999,OU=MyOU,OU=Users,OU=Accounts,DC=xxx,DC
> > =xxx,DC=xxx)(objectclass=group)(cn=*))][ou=GroupOU,ou=Right
> > Groups,ou=Groups,dc=xxx,dc=xxx,dc=xxx]. (Thu Oct 27 10:17:13 2011)
> 
> ^^From my earlier debug output. This query above works out which groups I'm
> a member of (and which ones to enumerate).
> 
> By slightly modifying the code I have significantly improved my ssh logins
> time.
> 
> If I change this code:
> 
>    src/providers/ldap/sdap_async_accounts.c (line 4228):
> 
>       filter = talloc_asprintf(state, "(&(%s=%s)(objectclass=%s)(%s=*))",
>                                opts->group_map[SDAP_AT_GROUP_MEMBER].name,
>                                clean_orig_dn,
>                                opts->group_map[SDAP_OC_GROUP].name,
>                                opts->group_map[SDAP_AT_GROUP_NAME].name);
> 
> to this:
> 
>       filter = talloc_asprintf(state,
> "(&(%s=%s)(objectclass=%s)(|(%s=group1)(cn=group2)(cn=group3)))", ...
> 
> Note I've changed (cn=*) to (|(cn=group1)(cn=group2)(cn=group3)).
> 
> My login times go from 28 seconds to 5 seconds on the first login.
> 
> So the reason being:  I'm a member of 150 groups in AD, but only 2-3 are
> ever relevant on the particular machine that I'm logged in to.  So having
> a group list filter like this reduces the scope of the ldap search
> significantly.  And speeds up the group enumeration.  Handy for
> organisations with very large directories like mine.
> 
> Are these options used anywhere?
> 
>      ldap_group_search_scope
>      ldap_group_search_filter

The filter option is currently used. In new SSSD versions (patches have been in 
master since yesterday) this works a bit differently. See 
https://fedorahosted.org/sssd/ticket/868.

> Or maybe an option like this in the config would be useful?
> 
>      ldap_group_list_filter = group1,group2,group3
> 
> Is this something that would be a good contribution for sssd?  Even if it's
> just an undocumented feature?  I could have a crack at it.
> 
> Cheers,
> 
> Tim.


Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111103/78b8c283/attachment.sig>


More information about the sssd-devel mailing list