[SSSD] [PATCH] Exit offline mode only if server is available.

Michal Židek mzidek at redhat.com
Fri Jul 4 10:34:34 UTC 2014


On 07/04/2014 11:05 AM, Jakub Hrozek wrote:
> On Fri, Jul 04, 2014 at 10:16:21AM +0200, Sumit Bose wrote:
>> On Thu, Jul 03, 2014 at 01:56:09PM +0200, Michal Židek wrote:
>>> Hi,
>>>
>>> this patch solves the ticket
>>> https://fedorahosted.org/sssd/ticket/2355
>>>
>>> I was able to reproduce the slowdowns that the
>>> reported experienced by pausing a virtual machine
>>> with the server. With this patch the slowdowns
>>> no longer appear.
>>>
>>> I use the already implemented function check_if_online
>>> in the new periodic task. See patch description
>>> for more details.
>>
>> I have one minor concern with the approach. On busy systems there is no
>> difference after a minute SSSD tries to go online. But if the system is
>> idle SSSD waited for some activity before tying to go online. With your
>> patch it will continue to try to go online every minute. For a system
>> running idle during the night this might be a lot of useless request.
>>
>> I wonder if the current online-check can just be made a background task
>> and the backend returns immediately with the offline status? For busy
>> systems there would be basically no difference as well. For the running
>> idle over night use-case there would be a little drawback. With your
>> scheme if SSSD goes online during the night the first request in the
>> morning already it attempted online. While with my suggestion it will
>> still be offline. But since the first would be a lookup request in most
>> case and an authentication following this has a fair chance to already
>> to online I think it is only a minor drawback.
>
> I think this is a good suggestion. Yes there is a drawback, but I think
> it can be dismissed because:
>      1) if the system was running offline, checks that usually involve
>      going to the server like the possibility of a password change or
>      group membership change wouldn't still propagate. So we are really
>      talking about a short window of 'going online'. Moreover, the
>      online/offline status is currently a bit hidden to the user so if
>      there is a system that typically goes offline,
>
>      2) In many cases (like the disconnected laptop use-case) SSSD would
>      be notified asynchronously that it's time to go online with the
>      resolv.conf inotify watch or libnl integration.
>
> I'm just wondering if we risk regression for systems that might go
> offline (maybe not laptops, but servers that might lose connectivity to
> authentication servers) but don't use cache_credentials. But still,
> we're only debating the first authentication after going offline, the
> authentication requests during the offline state would still fail, so
> this is a moot point probably..
>
>>
>> Please note that this is just a suggestion, your patch is fine and it is
>> a big improvement of the current behaviour. If you or others prefer to
>> keep it this way I'm fine and I'll happily would start to review the
>> patch.
>>
>> bye,
>> Sumit
>>

Hi Sumit,

actually your suggestion was one of my first ideas, but
It looked like strange behaviour to me if the first
getent (or any request for data not present int the
cache) after offline_timeout period returned nothing
even if the server was already available and the second
(1 or 2 seconds after the first) returned proper data. I
thought this may be considered a bug for some people (even
if it is not a major regression :) ). The patch I sent
was then an improvement over this initial idea (from my POV).

I understand your suggestion and concern, but I would
prefer to stick with the approach in the patch I sent.

Thanks,
Michal



More information about the sssd-devel mailing list