[SSSD-users] SSSD with 389DS

Dmitri Pal dpal at redhat.com
Thu Jan 16 13:29:49 UTC 2014


On 01/16/2014 05:29 AM, Mitja Mihelič wrote:
> Hi!
>
> We are running a CentOS6 server using SSSD that connects to 389DS
> containing 70k user entries. Both servers are fully updated.
> SSSD and 389DS package versions:
> sssd-1.9.2-129.el6_5.4.x86_64
> 389-ds-base-1.2.11.15-31.el6_5.x86_64
>
> Authoconfig was used to enable sssd.
>  authconfig --enablesssd --enablesssdauth
> --ldapbasedn=dc=users,dc=company,dc=tld --enableshadow
> --enablemkhomedir --enablelocauthorize --update
> PAM an NSS configs were updated as well.
> I have attached our sssd.conf.
>
> The setup itself works allowing users to authenticate, but we are
> concerned about the performance.
> At first we tried with enumeration enabled, but there was a
> significant responsiveness drop during enumeration. A simple getent -s
> sss passwd USERNAME took more than 15 seconds. Result paging did not
> help.
>
> Next we turned enumeration off and deleted the cache for a clean
> start. We tried simple getent requests with 1000 random usernames
> taken from a file. We ran the bash script consecutively a few times.
> The results:
> - run 1: 0m10.831s
> - run 2: 0m20.914s
> - run 3: 0m31.422s
> and so on. Each run took about 10 seconds more than the previous one.
> During the test sssd_be was using 100% of one core. During this time
> 389DS was practically idling. Its load (CPU, I/O) hardly showed any
> change.
>
> What could be the reason for this performace issue?
> How would we best go about tuning this system?
>
> Regards, Mitja
>
>
>
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users

Can it be due to group membership refresh?
Do you have a group that all 70K users are in?

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20140116/c2af5ba0/attachment.html>


More information about the sssd-users mailing list