[SSSD] Fwd: [Bug 743133] Performance regression with Kerberos authentication against AD

Jakub Hrozek jhrozek at redhat.com
Mon Mar 19 12:45:38 UTC 2012


On Mon, Mar 19, 2012 at 07:26:22AM -0400, Stephen Gallagher wrote:
> On Sun, 2012-03-18 at 21:31 +0100, Jakub Hrozek wrote:
> > On Sun, Mar 18, 2012 at 12:54:35PM -0400, Dmitri Pal wrote:
> > > Should we make it a default option?
> > > It seems like in most cases it helps a lot.
> 
> Not really in "most cases". It helps a lot in Active Directory
> environments because AD is pathological about referrals. It always
> forces three referrals at every non-base search lookup, regardless of
> whether such referrals would accomplish anything. This means that for
> each level of nested groups, we end up with three useless searches that
> take a lot of wallclock time).
> 
> > 
> > Changing the default might help performance but it might also cause the
> > SSSD to not return valid data..and historically we've been preferring
> > correct over fast.
> > 
> > Perhaps we should only document the proc and cons better?
> 
> I agree with Jakub. In some environments, failing to support referrals
> can lead to missing data. I don't think we want that to be the default,
> even for a sizeable performance gain. Furthermore, since defaulting to
> having it on has been the case for quite a while now, changing the
> default would negatively impact those environments that are relying on
> it.
> 
> So I think we need to leave it enabled by default. Probably we really
> need to document this better in the manpage and also add an entry to the
> SSSD FAQ on the wiki.

I agree.

https://fedorahosted.org/sssd/ticket/1265



More information about the sssd-devel mailing list