[SSSD] SSSD MemberOf / HBAC Process
JR Aquino
JR.Aquino at citrix.com
Wed Oct 5 19:04:26 UTC 2011
On Oct 5, 2011, at 10:39 AM, Stephen Gallagher wrote:
> On Wed, 2011-10-05 at 13:31 -0400, Dmitri Pal wrote:
>> On 10/05/2011 12:27 PM, JR Aquino wrote:
>>> Can we not just perform a targeted search of the Originating Source's hostname to query the hostgroups that it is a memberof and if it matches any of the hostgroups listed as a srchost = pass/fail the hbac?
>>>
>>> While there is the potential that 'every' host in the ldap directory could possibly attempt to login to a system, the likely hood seems far less probable vs caching only those systems / users who come calling?
>>>
>>> Won't there be a measurable exponential graph to follow as the contents of the ldap directory grows, so too does the process intensity of the sssd caching/processing vs only querying and caching he who knocks?
>>>
>>
>> This is how the original design was spelled and I do not see a reason
>> why it can't be done this way.
>
> It's not done this way because it requires many more LDAP lookups as
> well as losing the ability to handle a first-time remote host during an
> outage scenario. There is actually a net LOSS in performance on the LDAP
> side of things (since each LDAP lookup is expensive). In most cases, we
> spend less time on the wire by grabbing everything up front. Even in the
> worst cases, it's only slightly slower.
>
> The real bug here is with the cache-saving code which is taking tens of
> seconds for large amounts of data. We've already identified the cause of
> the problem. Note: this would still be an issue even if we switched to
> the above proposal, so it needs to be done either way.
Thank you for the clarification Stephen!
More information about the sssd-devel
mailing list