-
Story
-
Resolution: Unresolved
-
Major
-
rhel-9.8
-
None
-
Important
-
rhel-idm
-
None
-
False
-
False
-
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
None
This is a clone of issue RHEL-142964 to use for version rhel-9.8
–
Original description:
When user is a member of many groups (~10k), handling of `BE_REQ_INITGROUPS` by generic LDAP backend take extremely long time (can be several mins) that can exceed `SBUS_MESSAGE_TIMEOUT`, making 'sssd_nss' to abort client's request.
Logs inspections suggest that most of the time is spent in:
(1) `sdap_add_incomplete_groups()` takes ~35..45%
(2) `sysdb_update_members()` takes remaining ~55..65%
Step (2) adds user itself to all the groups stored at step (1)
The idea is that user can be added to groups already at step (1), thus eliminating the need for step (2) altogether.
- clones
-
RHEL-142964 Poor performance of `BE_REQ_INITGROUPS` handling by 'sssd_be' (LDAP RFC2307, no nested groups)
-
- Planning
-