[SSSD] [PATCHES][PRELIMINARY] Add support for AD's chain matching filter

Stephen Gallagher sgallagh at redhat.com
Sun Jun 10 19:32:28 UTC 2012


This is the second set of patches. These aren't quite ready for a
complete review. They are functional, but they need some discussion.

These patches attempt to implement
https://fedorahosted.org/sssd/ticket/1367.

For details on the "magic" filters, see
http://msdn.microsoft.com/en-us/library/windows/desktop/aa746475%
28v=vs.85%29.aspx (http://goo.gl/Czjlf if that doesn't come through
email well).



Patch 0001: Add new option "ldap_use_matching_rule_in_chain". This patch
is very incomplete. It only adds the new option. It is missing
SSSDConfig API entries and manpages. It is included because it's
necessary to test the other two patches.



Patch 0002: Add support for the chain matching filter when performing
group lookups. This is the contentious patch. It works, but it does not
have the performance gain I might have expected. I need to do some
re-testing on beefier hardware, but this approach has two major
performance downsides compared to the existing approach.

1) The existing approach takes advantage of the ASQ lookup, which (by
accident or design on Microsoft's part) ignores the limits on page size
per lookup. As a result, we can do a single lookup for all of the users
at a particular nesting level. With the match filter, we have to use the
paging control and request additional pages (meaning additional
round-trips). Net result is that the existing approach is faster for the
common case (only one or two nestings).

2) This is the bigger issue, though it may be a flawed test (I'll
explain in a moment). In addition to multiple round-trips to the server,
each round-trip in my tests was taking between 2x and 3x the time to
return. I suspect that this may be due in part to the fact that my
target server was a fairly wimpy CPU-and-memory VM, but it does reveal
that lookups using this filter against very large groups causes a
significantly increased strain on the AD server.

With both of those downsides in mind, I'm considering scrapping this
portion of the solution. Additional input is welcome.



Patch 0003: Add support for the chain matching filter when performing
initgroups lookups. This patch is much more performant (due in large
part to the fact that in the average case, the set of groups a user
belongs to will almost always fall within a single paged search). With
this patch, I consistently see 'time id -G <username>' reduced by 50%.
That makes this patch a clear performance victory in my mind.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-WIP-Add-ldap_use_matching_rule_in_chain-option.patch
Type: text/x-patch
Size: 1706 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120610/bac7336d/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-LDAP-Add-support-for-AD-chain-matching-extension-in-.patch
Type: text/x-patch
Size: 19665 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120610/bac7336d/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0008-LDAP-Add-support-for-AD-chain-matching-extension-in-.patch
Type: text/x-patch
Size: 15425 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120610/bac7336d/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120610/bac7336d/attachment.sig>


More information about the sssd-devel mailing list