[SSSD] memory cache for initgroups

Jakub Hrozek jhrozek at redhat.com
Mon Nov 3 12:57:08 UTC 2014


Hi,

we had short discussion on $SUBJECT with Simo on IRC already, but there
are multiple people involved from multiple timezones, so I think a mailing
list thread would be better trackable.

Can we add another memory cache file to SSSD, that would track
initgroups/getgrouplist results for the NSS responder? I realize initgroups
is a bit different operation than getpw{uid,nam} and getgr{gid,nam} but
what if the new memcache was only used by the NSS responder and at the
same time invalidated when initgroups is initiated by the PAM responder
to ensure the memcache is up-to-date?

I already know about two projects that would benefit from faster initgroups
operation - GlusterFS uses getgrouplist() quite a lot with some setups
and also in the IPA server mode, the SSSD running on the server becomes
a bit of a bottlenec for some operations.

Are there any technical reasons against a new memcache file that would
cache initgroups?



More information about the sssd-devel mailing list