Bug 1432903
| Summary: | Set GssProxy options to enable caching of ldap tickets | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Petr Vobornik <pvoborni> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Abhijeet Kasurde <akasurde> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.4 | CC: | akasurde, jcholast, ksiddiqu, mbabinsk, pvoborni, rcritten, ssorce, tscherf |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.5.0-2.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-08-01 09:46:16 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Petr Vobornik
2017-03-16 11:12:46 UTC
Upstream ticket: https://pagure.io/freeipa/issue/6771 Needed for IPA to be performant. Fixed upstream master: https://pagure.io/freeipa/c/4ee7e4ee6d6500d8b8935c9033388adc4cdbe672 Fixed upstream ipa-4-5: https://pagure.io/freeipa/c/62d39385e20b3e1b059466f37cc063833355551e The difference between the option turned off and turned on is that when the option is turned off each request to the LDAP server requires a roundtripto the KDC to acquire an LDAP ticket, while that is not necessary with the option tunerd on. So to test you can simply compare two runs (before and after) where you use the IPA API (either vina ipa command or via web UI) to perform a number of operations as a specific test user. With the option turned off you should see in krb5kdc.log a request for an ldap/<ipa-server> ticket by 'test' user for each operation. Withthe option turned on you should see only one (or few) request in krb5kdc.log for all operations. HTH. See instructions above Verified using IPA version :: ipa-server-4.5.0-14.el7.x86_64 Marking BZ as verified. Performed sanity tests and integration tests for verification. As per Comment #7, seen only single ldap/<server> request for all operations. # tail -f /var/log/krb4kdc.log Jun 06 06:34:13 ipaserver01.testrelm.test krb5kdc[16265](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.19.34.11: ISSUE: authtime 1496744877, etypes {rep=18 tkt=18 ses=18}, HTTP/ipaserver01.testrelm.test for ldap/ipaserver01.testrelm.test Jun 06 06:34:13 ipaserver01.testrelm.test krb5kdc[16265](info): ... CONSTRAINED-DELEGATION s4u-client=testuser1 Jun 06 06:34:13 ipaserver01.testrelm.test krb5kdc[16265](info): closing down fd 12 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2304 |