[SSSD] getent returns only single users
Jakub Hrozek
jhrozek at redhat.com
Mon Apr 15 12:28:43 UTC 2013
On Mon, Apr 15, 2013 at 01:20:37PM +0100, John Hodrien wrote:
> On Mon, 15 Apr 2013, Jakub Hrozek wrote:
>
> >From past conversations I know that your environment is rather big, so I
> >suspect you are hitting either ldap_enumeration_search_timeout (the
> >actual ldapsearch takes more than 60 seconds) or then saving the results
> >takes so long that the monitor kills the back end.
>
> That sounds plausible.
>
> >>sssd-1.9.2-82.4.el6_4.x86_64
> >>
> >>That said, I'm fairly sure I'd never want to use enumerate = true
> >
> >I agree, but the reality is that users turn on enumeration quite
> >frequently so longish-term (1.11 maybe, but probably 1.12) we should
> >improve the enumeration task to be able to handle even very large
> >directories.
>
> I guess I'm not clear *why* people feel they need enumeration.
>
It's not completely clear to me either, the most frequent answer I heard
was "convenience".
> >Currently, as you see from your experience, it's not great when it comes
> >to handling large number of users and groups..
>
> But is it *ever* going to be possible to get to a state where full enumeration
> with large trees is sane?
>
> jh
I haven't really done any experiments or design, but we would have to
split the current single huge request into several smaller ones in order
to avoid starving the sssd_be event queue. I'm not exactly sure how,
though.
More information about the sssd-devel
mailing list