[SSSD] [PATCH] IPA: Do not download or store the member attribute of host groups

Stephen Gallagher sgallagh at redhat.com
Mon Jun 24 12:04:34 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/23/2013 03:12 PM, Jakub Hrozek wrote:
> The attached patch applies on both master and sssd-1-9 and fixes: 
> https://fedorahosted.org/sssd/ticket/1806
> 
> The IPA provider attempted to store the original value of member
> attribute to the cache. That caused the memberof plugin to process
> the values which was really CPU intensive.
> 
> We don't use the values anywhere and rely on the originalDN
> instead, so it's safe to avoid even downloading them.
> 
> Many thanks to Andreas and Simo for their help debugging the
> problem.
> 

Nack

I was thinking that we might consider replacing SYSDB_MEMBER with
SYSDB_ORIG_MEMBER (so it gets translated to originalMember instead),
but if we're really not consuming it anywhere at all, I agree that it
makes sense to save bandwidth and storage. So the patch is fine as it
is, except for one thing.


As a one-time event, we should also update the DB version and purge
these entries that already exist. The reason for that is that in the
future if we had to re-process the member/memberOf relations in
another update, we don't want to force these to be re-evaluated.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlHINdIACgkQeiVVYja6o6OdFACZAWdYATpK2AACva3ptRhsXAxy
8A4An26jxp6wWmqYkiqFfiSL1FK3aRY+
=1G4i
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list