[SSSD] [PATCH] LDAP/AD: do not resolve group members during tokenGroups request

Jakub Hrozek jhrozek at redhat.com
Tue Mar 17 11:00:34 UTC 2015


On Mon, Mar 16, 2015 at 03:07:44PM +0100, Jakub Hrozek wrote:
> On Tue, Mar 10, 2015 at 03:43:41PM +0100, Sumit Bose wrote:
> > Hi,
> > 
> > with this patch I hope to improve the initgroup-request performance
> > especially is the user is a member of many nested groups. Currently all
> > groups the user is a member of which are not in the cache are resolved
> > completely with all members and nested groups. With this patch only the
> > group object is looked up to determine the type of the group, POSIX GID
> > (if any), SID, ... Resolving all members is deferred until a request to
> > resolve this specific groups is received. This should speed up plain
> > getgrouplist() calls e.g. used by 'id -G'. Please note that this will
> > not improve the overall speed of a 'id' call without any options because
> > in this case after calling getgrouplist() 'id' will call getgrgid() for
> > every GID returned by getgrouplist(). So in this case all groups are
> > resolved completely as well. But the overall time is now better spread
> > over many request and chances for timeout should be much lower.
> > 
> > bye,
> > Sumid
> 
> ACK
> 
> What we might also want to do in future is to first just gather the
> groups and then save them to conserve sysdb transactions. But the ticket
> is an improvement on its own.

* master: d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1
* sssd-1-12: b8d9eca0d9469c1209161b31a0109d8e4ea2868c 



More information about the sssd-devel mailing list