[SSSD] memory cache for initgroups

Simo Sorce ssorce at redhat.com
Mon Nov 3 13:53:06 UTC 2014


On Mon, 3 Nov 2014 13:57:08 +0100
Jakub Hrozek <jhrozek at redhat.com> wrote:

> Hi,
> 
> we had short discussion on $SUBJECT with Simo on IRC already, but
> there are multiple people involved from multiple timezones, so I
> think a mailing list thread would be better trackable.
> 
> Can we add another memory cache file to SSSD, that would track
> initgroups/getgrouplist results for the NSS responder? I realize
> initgroups is a bit different operation than getpw{uid,nam} and
> getgr{gid,nam} but what if the new memcache was only used by the NSS
> responder and at the same time invalidated when initgroups is
> initiated by the PAM responder to ensure the memcache is up-to-date?

Can you describe the use case before jumping into a proposed solution ?

> I already know about two projects that would benefit from faster
> initgroups operation - GlusterFS uses getgrouplist() quite a lot with
> some setups and also in the IPA server mode, the SSSD running on the
> server becomes a bit of a bottlenec for some operations.

Is the problem related to accessing the main ldb cache, or the fact we
also go out and contact the IdM server ?

> Are there any technical reasons against a new memcache file that would
> cache initgroups?

The main reason would be potential inconsistency between this cache and
the users and groups caches, but I do not think that would be really a
big deal if there is a pretty good reason for the cache.

Do we need to insure all groups are resolvable in the groups cache ?
Or is it ok if gids returned by the getgrouplist are not immediately
available in the groups cache ?
What about the user ?

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list