[SSSD] SSSD MemberOf / HBAC Process

JR Aquino JR.Aquino at citrix.com
Wed Oct 5 19:04:26 UTC 2011


On Oct 5, 2011, at 10:39 AM, Stephen Gallagher wrote:

> On Wed, 2011-10-05 at 13:31 -0400, Dmitri Pal wrote:
>> On 10/05/2011 12:27 PM, JR Aquino wrote:
>>> Can we not just perform a targeted search of the Originating Source's hostname to query the hostgroups that it is a memberof and if it matches any of the hostgroups listed as a srchost = pass/fail the hbac?
>>> 
>>> While there is the potential that 'every' host in the ldap directory could possibly attempt to login to a system, the likely hood seems far less probable vs caching only those systems / users who come calling?
>>> 
>>> Won't there be a measurable exponential graph to follow as the contents of the ldap directory grows, so too does the process intensity of the sssd caching/processing vs only querying and caching he who knocks?
>>> 
>> 
>> This is how the original design was spelled and I do not see a reason
>> why it can't be done this way.
> 
> It's not done this way because it requires many more LDAP lookups as
> well as losing the ability to handle a first-time remote host during an
> outage scenario. There is actually a net LOSS in performance on the LDAP
> side of things (since each LDAP lookup is expensive). In most cases, we
> spend less time on the wire by grabbing everything up front. Even in the
> worst cases, it's only slightly slower.
> 
> The real bug here is with the cache-saving code which is taking tens of
> seconds for large amounts of data. We've already identified the cause of
> the problem. Note: this would still be an issue even if we switched to
> the above proposal, so it needs to be done either way.

Thank you for the clarification Stephen!




More information about the sssd-devel mailing list