[SSSD] Announcing SSSD 1.5.14

Jakub Hrozek jhrozek at redhat.com
Thu Nov 3 08:51:28 UTC 2011


On Thu, Nov 03, 2011 at 04:08:51PM +1000, GOLLSCHEWSKY, Tim wrote:
> Hi all.  Thanks to everyone for their help so far.
> 
> OK, I've been diving into the code today.  v1.5.15 tho since it just got released.
> 
> > (Thu Oct 27 10:17:13 2011) [sssd[be[XXX.XXX.XXX]]] [sdap_get_generic_step] (6): calling ldap_search_ext with  [(&(msSFU30PosixMember=CN=U999999,OU=MyOU,OU=Users,OU=Accounts,DC=xxx,DC=xxx,DC=xxx)(objectclass=group)(cn=*))][ou=GroupOU,ou=Right Groups,ou=Groups,dc=xxx,dc=xxx,dc=xxx]. (Thu Oct 27 10:17:13 2011)
> 
> ^^From my earlier debug output. This query above works out which groups I'm a member of (and which ones to enumerate).
> 
> By slightly modifying the code I have significantly improved my ssh logins time.
> 
> If I change this code:
> 
>    src/providers/ldap/sdap_async_accounts.c (line 4228):
> 
>       filter = talloc_asprintf(state, "(&(%s=%s)(objectclass=%s)(%s=*))",
>                                opts->group_map[SDAP_AT_GROUP_MEMBER].name,
>                                clean_orig_dn,
>                                opts->group_map[SDAP_OC_GROUP].name,
>                                opts->group_map[SDAP_AT_GROUP_NAME].name);
> 
> to this:
> 
>       filter = talloc_asprintf(state, "(&(%s=%s)(objectclass=%s)(|(%s=group1)(cn=group2)(cn=group3)))",
>                                ...
> 
> Note I've changed (cn=*) to (|(cn=group1)(cn=group2)(cn=group3)).
> 
> My login times go from 28 seconds to 5 seconds on the first login.
> 
> So the reason being:  I'm a member of 150 groups in AD, but only 2-3 are ever relevant on the particular machine that I'm logged in to.  So having a group list filter like this reduces the scope of the ldap search significantly.  And speeds up the group enumeration.  Handy for organisations with very large directories like mine.
> 
> Are these options used anywhere?
> 
>      ldap_group_search_scope
>      ldap_group_search_filter
> 

As Jan noted, these options will be deprecated in 1.7 and onwards. But
even in the current releases, they only limit the initial user/group
lookup (getent passwd/group), not group membership during initgroups.

> Or maybe an option like this in the config would be useful?
> 
>      ldap_group_list_filter = group1,group2,group3
> 
> Is this something that would be a good contribution for sssd?  Even if it's just an undocumented feature?  I could have a crack at it.
> 
> Cheers,
> 
> Tim.
> 
> 

I'm not sure if artificially trimming the group list is a good idea.
It wouldn't work for everyone and I would be wary of breaking access
control mechanisms.

We've been looking into the RFC2307bis performance recently and for
environments like yours, where the user is a member of large number of
groups, the biggest bottleneck is that we're looking up the groups the
user is a member of sequentially. There's a ticket #1062 to track making the
lookups parallel, but it's been put to the deffered bucket mainly because
we're trying to spend our resources on integrating with AD at the
winbind provider.

If you'd like to tackle #1062, I'm sure patches will be welcome.



More information about the sssd-devel mailing list