[SSSD] getent returns only single users

Jakub Hrozek jhrozek at redhat.com
Mon Apr 15 12:28:43 UTC 2013


On Mon, Apr 15, 2013 at 01:20:37PM +0100, John Hodrien wrote:
> On Mon, 15 Apr 2013, Jakub Hrozek wrote:
> 
> >From past conversations I know that your environment is rather big, so I
> >suspect you are hitting either ldap_enumeration_search_timeout (the
> >actual ldapsearch takes more than 60 seconds) or then saving the results
> >takes so long that the monitor kills the back end.
> 
> That sounds plausible.
> 
> >>sssd-1.9.2-82.4.el6_4.x86_64
> >>
> >>That said, I'm fairly sure I'd never want to use enumerate = true
> >
> >I agree, but the reality is that users turn on enumeration quite
> >frequently so longish-term (1.11 maybe, but probably 1.12) we should
> >improve the enumeration task to be able to handle even very large
> >directories.
> 
> I guess I'm not clear *why* people feel they need enumeration.
> 

It's not completely clear to me either, the most frequent answer I heard
was "convenience".

> >Currently, as you see from your experience, it's not great when it comes
> >to handling large number of users and groups..
> 
> But is it *ever* going to be possible to get to a state where full enumeration
> with large trees is sane?
> 
> jh

I haven't really done any experiments or design, but we would have to
split the current single huge request into several smaller ones in order
to avoid starving the sssd_be event queue. I'm not exactly sure how,
though.



More information about the sssd-devel mailing list