[SSSD] [PATCH] LDAP/AD: do not resolve group members during tokenGroups request

Lukas Slebodnik lslebodn at redhat.com
Mon Mar 16 15:03:00 UTC 2015


On (16/03/15 15:07), Jakub Hrozek wrote:
>On Tue, Mar 10, 2015 at 03:43:41PM +0100, Sumit Bose wrote:
>> Hi,
>> 
>> with this patch I hope to improve the initgroup-request performance
>> especially is the user is a member of many nested groups. Currently all
>> groups the user is a member of which are not in the cache are resolved
>> completely with all members and nested groups. With this patch only the
>> group object is looked up to determine the type of the group, POSIX GID
>> (if any), SID, ... Resolving all members is deferred until a request to
>> resolve this specific groups is received. This should speed up plain
>> getgrouplist() calls e.g. used by 'id -G'. Please note that this will
>> not improve the overall speed of a 'id' call without any options because
>> in this case after calling getgrouplist() 'id' will call getgrgid() for
>> every GID returned by getgrouplist(). So in this case all groups are
>> resolved completely as well. But the overall time is now better spread
>> over many request and chances for timeout should be much lower.
>> 
>> bye,
>> Sumid
>
>ACK
>
>What we might also want to do in future is to first just gather the
>groups and then save them to conserve sysdb transactions. But the ticket
>is an improvement on its own.

Shall we mention in release notes that "id user" and "id -G user" needn't
return the same results?

LS



More information about the sssd-devel mailing list