[SSSD] SSSD MemberOf / HBAC Process

Stephen Gallagher sgallagh at redhat.com
Wed Oct 5 17:39:42 UTC 2011


On Wed, 2011-10-05 at 13:31 -0400, Dmitri Pal wrote:
> On 10/05/2011 12:27 PM, JR Aquino wrote:
> > Can we not just perform a targeted search of the Originating Source's hostname to query the hostgroups that it is a memberof and if it matches any of the hostgroups listed as a srchost = pass/fail the hbac?
> >
> > While there is the potential that 'every' host in the ldap directory could possibly attempt to login to a system, the likely hood seems far less probable vs caching only those systems / users who come calling?
> >
> > Won't there be a measurable exponential graph to follow as the contents of the ldap directory grows, so too does the process intensity of the sssd caching/processing vs only querying and caching he who knocks?
> >
> 
> This is how the original design was spelled and I do not see a reason
> why it can't be done this way.

It's not done this way because it requires many more LDAP lookups as
well as losing the ability to handle a first-time remote host during an
outage scenario. There is actually a net LOSS in performance on the LDAP
side of things (since each LDAP lookup is expensive). In most cases, we
spend less time on the wire by grabbing everything up front. Even in the
worst cases, it's only slightly slower.

The real bug here is with the cache-saving code which is taking tens of
seconds for large amounts of data. We've already identified the cause of
the problem. Note: this would still be an issue even if we switched to
the above proposal, so it needs to be done either way.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111005/c53cb37a/attachment.sig>


More information about the sssd-devel mailing list