[SSSD-users] SSSD with 389DS

Mitja Mihelič mitja.mihelic at arnes.si
Thu Jan 16 10:29:53 UTC 2014


Hi!

We are running a CentOS6 server using SSSD that connects to 389DS 
containing 70k user entries. Both servers are fully updated.
SSSD and 389DS package versions:
sssd-1.9.2-129.el6_5.4.x86_64
389-ds-base-1.2.11.15-31.el6_5.x86_64

Authoconfig was used to enable sssd.
  authconfig --enablesssd --enablesssdauth 
--ldapbasedn=dc=users,dc=company,dc=tld --enableshadow --enablemkhomedir 
--enablelocauthorize --update
PAM an NSS configs were updated as well.
I have attached our sssd.conf.

The setup itself works allowing users to authenticate, but we are 
concerned about the performance.
At first we tried with enumeration enabled, but there was a significant 
responsiveness drop during enumeration. A simple getent -s sss passwd 
USERNAME took more than 15 seconds. Result paging did not help.

Next we turned enumeration off and deleted the cache for a clean start. 
We tried simple getent requests with 1000 random usernames taken from a 
file. We ran the bash script consecutively a few times. The results:
- run 1: 0m10.831s
- run 2: 0m20.914s
- run 3: 0m31.422s
and so on. Each run took about 10 seconds more than the previous one.
During the test sssd_be was using 100% of one core. During this time 
389DS was practically idling. Its load (CPU, I/O) hardly showed any change.

What could be the reason for this performace issue?
How would we best go about tuning this system?

Regards, Mitja

-- 
--
Mitja Mihelič
ARNES, Tehnološki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia
tel: +386 1 479 8877, fax: +386 1 479 88 78

-------------- next part --------------
[domain/default]
ldap_tls_reqcert = demand
ldap_id_use_start_tls = True
cache_credentials = True
ldap_search_base = dc=users,dc=company,dc=tld
ldap_group_member = uniquemember
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldaps://ldap.company.si
ldap_tls_cacertdir = /etc/openldap/cacerts
enumerate = false
min_id = 1
ldap_default_bind_dn = cn=SSSDUSER,ou=system,dc=company,dc=tld
ldap_default_authtok_type = obfuscated_password
ldap_default_authtok = PASSWORD_HERE 
ldap_disable_paging = false
ldap_enumeration_refresh_timeout = 900
ldap_enumeration_search_timeout = 75

[sssd]
services = nss, pam
config_file_version = 2
domains = default

[nss]
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
memcache_timeout = 1200
enum_cache_timeout = 400
entry_negative_timeout = 5
debug_level = 0x0400

[pam]
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
debug_level = 0x0400

[sudo]

[autofs]


More information about the sssd-users mailing list