[SSSD] [PATCH] AD: add entry_cache_gpo_timeout option

Yassir Elley yelley at redhat.com
Thu Jul 24 10:53:24 UTC 2014


Hi,

The attached patch adds support for an "entry_cache_gpo_timeout" option, which allows an admin to specify how many seconds the backend should consider locally stored gpo policy files to be valid before asking the backend again. This is an additional performance enhancement (along with comparing gpo versions to avoid unnecessary downloads). The timeout is set when a gpo entry is stored in the cache (which only happens after policy files have been downloaded). 

During the processing of a gpo, if the gpo's cache timeout has not elapsed, the backend does not interact with the gpo_child at all (and therefore doesn't download any files from the smb server). Rather, it re-uses the policy files that are already stored locally. Obviously, no gpo version comparisons need to be made in this case. If the timeout has elapsed (or there is no gpo entry in the cache), then the backend does interact with the gpo child in the usual manner (including comparing gpo versions to avoid unnecessary downloads). Note that the entry_cache_gpo_timeout option is *not* an expiration for the data in the gpo cache entry (which includes the cached_gpt_version). Indeed, the cached_gpt_version is never considered to be "expired".

Note that this patch does not add support for offline mode, which will be implemented in a subsequent patch.

Regards,
Yassir.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-AD-GPO-add-entry_cache_gpo_timeout-option.patch
Type: text/x-patch
Size: 28651 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140724/f8ad4845/attachment.bin>


More information about the sssd-devel mailing list