[sssd PR#5343][opened] autofs: distinguish between empty cache and offline state
by pbrezina
URL: https://github.com/SSSD/sssd/pull/5343
Author: pbrezina
Title: #5343: autofs: distinguish between empty cache and offline state
Action: opened
PR body:
"""
If the cache is empty and SSSD is offline we now return a proper
error code to autofs so it can iplement a proper retry logic to
fetch the maps when SSSD comes back offline.
This also requires changes in autofs which are not yet available
so the best way to test it with SSSD is to use the autofs test
tool (autofs_test_client) to see that it returns correct error
codes.
Resolves:
https://github.com/SSSD/sssd/issues/3413
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5343/head:pr5343
git checkout pr5343
3 years, 4 months
- 2
- 29
[sssd PR#5375][opened] kcm: improve performance for large ccaches
by pbrezina
URL: https://github.com/SSSD/sssd/pull/5375
Author: pbrezina
Title: #5375: kcm: improve performance for large ccaches
Action: opened
PR body:
"""
KCM protocol is not designed for highest performance and our impelmentation
contained three huge bottle necks - encryption, json serialization and too
much cache access. These are unnecessary - the encryption is meaningless
since once you get access to the root-owned cache file you can also access
the decryption key so there is no added security. JSON is unneccessarily large,
requires base64 encoding of credentials and takes too long to parse. The cache
was accessed with each GET_CRED_BY_UUID operation. This operation is called
once for each credential when iterating over them.
The iteration over credentials in Kerberos looks like this:
```
// GET_CRED_UUID_LIST - fetch list of credentials and create a cursor
krb5_cc_start_seq_get(context, cache, &cur);
// GET_CRED_BY_UUID - get credential by uuid
while ((ret = krb5_cc_next_cred(context, cache, &cur, &creds)) == 0) {
do_something(creds);
krb5_free_cred_contents(context, &creds);
}
// destroy the cursor
krb5_cc_end_seq_get(context, cache, &cur);
```
I have addressed these bottlenecks and the performance has improved dramatically.
The test was to establish security context via GSSAPI with 200 services using
[this testing app](https://github.com/pbrezina/gssapi-auth).
```
# run gssapi server
../gssapi-auth-server -s socket -k test.keytab &
# get service tickets
for i in $(seq 1 200); do ../gssapi-auth-client -s socket -n test$i(a)master.client.vm ; done
# terminate server
pkill gssapi-auth-server
```
Here are the results:
| memory | secdb | keyring
--------------------------------------------
before | 19m59.713s | 33m41.337s |
after | 1m50.610s | 1m55.496s | 0m2.643s
It is still pretty slow in comparison with keyring. The next bottleneck is
communication over the socket. Keyring stores list of credentials directly
in the cursor so `krb5_cc_next_cred` returns data immediately without calling
to the keyring. We should do the same in KCM however this requires changes
in the KCM protocol and needs to be communicated with its upstream.
Resolves: https://github.com/SSSD/sssd/issues/5349
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5375/head:pr5375
git checkout pr5375
3 years, 4 months
- 3
- 40