[SSSD] [PATCH] LDAP/AD: do not resolve group members during tokenGroups request

Jakub Hrozek jhrozek at redhat.com
Mon Mar 16 14:07:44 UTC 2015


On Tue, Mar 10, 2015 at 03:43:41PM +0100, Sumit Bose wrote:
> Hi,
> 
> with this patch I hope to improve the initgroup-request performance
> especially is the user is a member of many nested groups. Currently all
> groups the user is a member of which are not in the cache are resolved
> completely with all members and nested groups. With this patch only the
> group object is looked up to determine the type of the group, POSIX GID
> (if any), SID, ... Resolving all members is deferred until a request to
> resolve this specific groups is received. This should speed up plain
> getgrouplist() calls e.g. used by 'id -G'. Please note that this will
> not improve the overall speed of a 'id' call without any options because
> in this case after calling getgrouplist() 'id' will call getgrgid() for
> every GID returned by getgrouplist(). So in this case all groups are
> resolved completely as well. But the overall time is now better spread
> over many request and chances for timeout should be much lower.
> 
> bye,
> Sumid

ACK

What we might also want to do in future is to first just gather the
groups and then save them to conserve sysdb transactions. But the ticket
is an improvement on its own.



More information about the sssd-devel mailing list