[SSSD] How to tune the failover mecanism ?

Dmitri Pal dpal at redhat.com
Mon Dec 3 16:01:29 UTC 2012


On 12/03/2012 10:56 AM, Dmitri Pal wrote:
> On 12/03/2012 10:35 AM, Olivier wrote:
>> Hello everyone,
>>
>> I use sssd to authenticate users on redhat boxes,
>> as a layer between pam and my ldap serverS.
>>
>> User ldap accounts are announced but 3 replicated
>> (open)ldap servers.
>>
>> I have declared my 3 servers in sssd.conf:
>>
>> ldap_uri: ldap://ldap1.example.fr,ldap://ldap2.example.fr,ldap://ldap3.example.fr
>>
>> That works, but I would like now to better tune the
>> sssd failover and cache function offered by sssd,
>> and I'm a bit stuck.
>>
>> Questions :
>>
>> 1- about the failover mecanism, I read in sssd-ldap man page :
>>
>> " If the resolution attempt succeeds, the back end tries to connect to
>> a service on this machine.
>>   If the service connection attempt fails, then only this particular
>> service is considered offline and
>>   the back end automatically switches over to the next service."
>>
>> I there any way to tune the "timeout" after which the bakend considers
>> that the attempt
>> to connect to a server has failed and therefore that it's time to try
>> the next one ?
> I think the re-connection timeout is hardcoded as 30, I vaguely recall a
> discussion about it four years ago.
> If/when it is confirmed IMO would make sense to file an RFE.
> I am leaning to it be configurable  and think that 5 or 10 second
> timeout should be sufficient.
>
>
>> 2- I'm a bit stuck to configure the behaviour of the boxes with regard to
>>     sssd cache (in anthother word, I have not perfectly understood under
>>     which condition sssd returns cached information rather than querying
>>     ldap and how to tune that).
>>
>> Intuitively, I would something like the sssd cache for an entry to be returned
>> rather than querying ldap if :
>>
>> -> the cache was "recently" refreshed for that entry ( not sur what I
>> should mean
>>     by "recently" )
>> -> no ldap server respond (I suspect that this would be tuned with
>> "ldap_search_timeout" ?)
>>
>> Any help from anyone ?
> If the system is offline the data is served from the cache.
> If the system is online but the entry is not available or the entry is
> pretty old (defined by the cache expiration timeout) then the data is
> fetched from LDAP and returned to the caller in parallel to updating cache.
> If the system is online and entry is available from the cache and it is
> younger than half of its life time then it is served from the cache.
> If the system is online and entry is available from the cache and it is
> older than half of its life time then it is served from the cache but an
> async operation to fetch the entry from LDAP and update the cache is
> launched in the background.
>
> HTH
>

And yes this is the original logic of the SSSD cache not counting the
fast cache on top of it.

>> Thanks,
>>
>> ---
>> Olivier
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list