Re: [SSSD] [PATCH] LDAP/AD: do not resolve group members during tokenGroups request
On Mon, Mar 16, 2015 at 04:03:00PM +0100, Lukas Slebodnik wrote:
On (16/03/15 15:07), Jakub Hrozek wrote:
>On Tue, Mar 10, 2015 at 03:43:41PM +0100, Sumit Bose wrote:
>> Hi,
>>
>> with this patch I hope to improve the initgroup-request performance
>> especially is the user is a member of many nested groups. Currently all
>> groups the user is a member of which are not in the cache are resolved
>> completely with all members and nested groups. With this patch only the
>> group object is looked up to determine the type of the group, POSIX GID
>> (if any), SID, ... Resolving all members is deferred until a request to
>> resolve this specific groups is received. This should speed up plain
>> getgrouplist() calls e.g. used by 'id -G'. Please note that this will
>> not improve the overall speed of a 'id' call without any options
because
>> in this case after calling getgrouplist() 'id' will call getgrgid() for
>> every GID returned by getgrouplist(). So in this case all groups are
>> resolved completely as well. But the overall time is now better spread
>> over many request and chances for timeout should be much lower.
>>
>> bye,
>> Sumid
>
>ACK
>
>What we might also want to do in future is to first just gather the
>groups and then save them to conserve sysdb transactions. But the ticket
>is an improvement on its own.
Shall we mention in release notes that "id user" and "id -G user"
needn't
return the same results?
I'm not sure what you mean. Both should return the same list of groups,
plain id would just need more time with an empty cache because if will
completely resolve all groups as well.
bye,
Sumit
LS
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel