[SSSD] [PATCHES] HBAC performance enhancements

Stephen Gallagher sgallagh at redhat.com
Thu Oct 13 20:03:48 UTC 2011


On Mon, 2011-10-10 at 13:25 +0200, Jakub Hrozek wrote:
> On Fri, Oct 07, 2011 at 02:12:08PM -0400, Stephen Gallagher wrote:
> > https://fedorahosted.org/sssd/ticket/1029
> > 
> > The problem here is that we were trying to perform an "optimization" by
> > bulk-deleting the contents of the service and host lists in the sysdb
> > before dumping into it the new data we received from LDAP.
> > 
> > This was causing a major performance hit on large deployments, because
> > this recursive delete was repeatedly hitting a weak point of the
> > memberOf plugin. However, upon closer analysis, Sumit pointed out that
> > we don't actually need to rely on the local memberOf plugin in this
> > situation.
> > 
> > These patches remove the member/memberOf relationship from
> > host/hostgroup and service/servicegroup entries in the SSSD. As a
> > result, we don't invoke the memberOf plugin during the mass-delete and
> > we see a significant performance increase.
> > 
> > The patches [ab]use the fact that we know the DN structure of the hosts,
> > service and groups so that we don't need to go and look them up when
> > constructing the requests. Instead we take the originalMemberOf object
> > and interpret the value directly from it. This is much faster than
> > searching the sysdb for the original object to get its fqdn or cn value.
> 
> Patch 1/3 - Ack
> 
> Patch 2/3 - Nack,
> In hbac_eval_service_element(), I assume you meant to loop until
> i < el->num_values, count is always 1 there.
> 
> > +    for (i = j = 0; i < count; i++) {
> > +        ret = get_ipa_servicegroupname(tmp_ctx, sysdb,
> > +                                       (const char *)el->values[i].data,
> > +                                       &name);
> > +        if (ret != EOK && ret != ENOENT) goto done;
> >  
> > -        DEBUG(6, ("Added service group [%s] to the eval request\n",
> > -                  svc->groups[i]));
> > +        /* ENOENT means we had a memberOf entry that wasn't a
> > +         * service group. We'll just ignore those (could be
> > +         * HBAC rules)
> > +         */
> > +
> > +        if (ret == EOK) {
> > +            svc->groups[j] = talloc_steal(svc->groups, name);
> > +            j++;
> > +        }
> 
> Patch 3/3 - Nack, same comment as above. Also please change the comment in
> get_ipa_hostgroupname() from "It's not a service." to "It's not a hostgroup."

Thanks, good catch.

New patches attached.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-HBAC-Do-not-save-member-memberOf-links.patch
Type: text/x-patch
Size: 6028 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111013/05bf1a4e/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-HBAC-Use-originalMember-for-identifying-servicegroup.patch
Type: text/x-patch
Size: 10190 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111013/05bf1a4e/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-HBAC-Use-originalMember-for-identifying-hostgroups.patch
Type: text/x-patch
Size: 9823 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111013/05bf1a4e/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111013/05bf1a4e/attachment.sig>


More information about the sssd-devel mailing list