[SSSD] [PATCHES] HBAC performance enhancements

Stephen Gallagher sgallagh at redhat.com
Fri Oct 7 18:12:08 UTC 2011


https://fedorahosted.org/sssd/ticket/1029

The problem here is that we were trying to perform an "optimization" by
bulk-deleting the contents of the service and host lists in the sysdb
before dumping into it the new data we received from LDAP.

This was causing a major performance hit on large deployments, because
this recursive delete was repeatedly hitting a weak point of the
memberOf plugin. However, upon closer analysis, Sumit pointed out that
we don't actually need to rely on the local memberOf plugin in this
situation.

These patches remove the member/memberOf relationship from
host/hostgroup and service/servicegroup entries in the SSSD. As a
result, we don't invoke the memberOf plugin during the mass-delete and
we see a significant performance increase.

The patches [ab]use the fact that we know the DN structure of the hosts,
service and groups so that we don't need to go and look them up when
constructing the requests. Instead we take the originalMemberOf object
and interpret the value directly from it. This is much faster than
searching the sysdb for the original object to get its fqdn or cn value.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-HBAC-Do-not-save-member-memberOf-links.patch
Type: text/x-patch
Size: 6028 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111007/786fb6a7/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-HBAC-Use-originalMember-for-identifying-servicegroup.patch
Type: text/x-patch
Size: 10035 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111007/786fb6a7/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-HBAC-Use-originalMember-for-identifying-hostgroups.patch
Type: text/x-patch
Size: 9816 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111007/786fb6a7/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111007/786fb6a7/attachment.sig>


More information about the sssd-devel mailing list