[SSSD-users] Caching credentials while online

Jacob Weber jacob at jacobweber.com
Thu Aug 14 23:18:04 UTC 2014


> Can you file a RFE?

Sure: https://fedorahosted.org/sssd/ticket/2408

> Could you check in the logs what takes the longest during the whole
> request? If your server is really fast, maybe you can add
> debug_microseconds to the config file to increase the resolution..

I tried, but I'm not seeing a particular area that's slower than others. I can try looking more carefully when I have some time.

The lookup doesn't make a huge difference in one request, but it adds up.

In particular, this machine runs Subversion over Apache, and authenticates against the system users (using SSSD). Unfortunately SVN over Apache makes a ton of separate requests. Since SSSD doesn't cache, I'm probably going to look into having Apache use a method that does, like mod_ldap.

> Maybe the new option could cover both the initgroups and authentication,
> not sure. It's a bit of slippery slope, because on a Linux system
> authentication is actually the only moment where groups are set. On the
> other hand, group membership don't change that often..

Plus, if you're doing offline caching, you're already going down that slope...

Jacob


More information about the sssd-users mailing list