Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-142964

Poor performance of `BE_REQ_INITGROUPS` handling by 'sssd_be' (LDAP RFC2307, no nested groups)

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • Icon: Story Story
    • Resolution: Unresolved
    • Icon: Major Major
    • rhel-10.3
    • rhel-8.10.z, rhel-9.8, rhel-10.2
    • sssd
    • None
    • Important
    • rhel-idm
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      When user is a member of many groups (think of 5k or more), handling of `BE_REQ_INITGROUPS` (triggered by, for example, `id $user`) by generic SSSD LDAP backend (this ticket is specifically about RFC2307 setup, i.e. no nested groups) takes extremely long time (can be several mins). With membership large enough this can even exceed `SBUS_MESSAGE_TIMEOUT`, making 'sssd_nss' to abort client's request (so `id` returns nothing).

      The purpose of this ticket is to track measurable performance improvements of described scenario.

              sssd-maint SSSD Maintainers
              atikhono@redhat.com Alexey Tikhonov
              Alexey Tikhonov Alexey Tikhonov
              Shridhar Gadekar Shridhar Gadekar
              Louise McGarry Louise McGarry
              Votes:
              1 Vote for this issue
              Watchers:
              14 Start watching this issue

                Created:
                Updated: