Bug 1415162
| Summary: | ipa-extdom-extop plugin can exhaust DS worker threads | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Thorsten Scherf <tscherf> | |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> | |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> | |
| Severity: | high | Docs Contact: | Aneta Šteflová Petrová <apetrova> | |
| Priority: | high | |||
| Version: | 7.3 | CC: | abokovoy, anazmy, chhudson, dj, ekeck, enewland, fweimer, gparente, ipa-maint, jhrozek, ldelouw, mkosek, myusuf, pasik, pvoborni, rcritten, sbose, striker, tbordaz | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | ipa-server-4.5.4-5.el7 | Doc Type: | Bug Fix | |
| Doc Text: |
The IdM LDAP server no longer becomes unresponsive when resolving an AD user takes a long time
When the System Security Services Daemon (SSSD) took a long time to resolve a user from a trusted Active Directory (AD) domain on the Identity Management (IdM) server, the IdM LDAP server sometimes exhausted its own worker threads. Consequently, the IdM LDAP server was unable to respond to further requests from SSSD clients or other LDAP clients. This update adds a new API to SSSD on the IdM server, which enables identity requests to time out. Also, the IdM LDAP extended identity operations plug-in and the Schema Compatibility plug-in now support this API to enable canceling requests that take too long. As a result, the IdM LDAP server can recover from the described situation and keep responding to further requests.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 1473571 1473577 (view as bug list) | Environment: | ||
| Last Closed: | 2018-04-10 16:40:25 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1473571 | |||
| Bug Blocks: | 1420851, 1467835, 1472344 | |||
| Attachments: | ||||
|
Description
Thorsten Scherf
2017-01-20 12:40:46 UTC
Created attachment 1249898 [details]
tar ball with test build with a reduced client timeout
Created attachment 1301685 [details]
tar-ball with test build
Note that this solution is composed from changes in ipa, sssd and slapi-nis: * ipa: Bug 1415162 - this bug * sssd: Bug 1473571 * slapi-nis: Bug 1473577 Created attachment 1337857 [details]
valgrind output
Added a doc. Let me know, Aneta, if this is enough. Fixed upstream.
master:
78ad1cf ipa-extdom-extop: refactor nsswitch operations
ipa-4-6:
d1dd794 ipa-extdom-extop: refactor nsswitch operations
ipa-4-5:
a2da9f9 ipa-extdom-extop: refactor nsswitch operations
Created attachment 1364463 [details]
tar-ball with test build rebased to sssd-1.15.2-50.el7_4.6
version:
ipa-server-4.5.4-7.el7.x86_64
sssd-1.16.0-14.el7.x86_64
sss_nss_getpwnam_timeout_test.c
--------------------------------------------------------------
#include <stdio.h>
#define IPA_389DS_PLUGIN_HELPER_CALLS 1
#include <sss_nss_idmap.h>
int main(int argc, char* argv[])
{
int ret;
struct passwd pwd;
struct passwd *pwd_result;
char buffer[1024];
size_t buflen = sizeof(buffer);
if (argc != 2) {
fprintf(stderr, "Missing argument.\n");
return 1;
}
ret = sss_nss_getpwnam_timeout(argv[1], &pwd, buffer, buflen, &pwd_result,
0, 1000);
fprintf(stderr, "Done [%d].\n", ret);
return ret;
}
--------------------------------------------------------------
steps:
Make sure the 'libsss_nss_idmap-devel' is installed (yum install libsss_nss_idmap-devel) and then call:
1. gcc -Wall -Wextra -Werror sss_nss_getpwnam_timeout_test.c -o sss_nss_getpwnam_timeout_test -lsss_nss_idmap
2. set 'timeout = 999999' in the [domain/...] section of sssd.conf
3. restart the sssd service.
4. call $ kill -STOP $(pidof sssd_be)
5. call './sss_nss_getpwnam_timeout_test non_exisiting_user_name'
this call should return after about 1s with "Done [5]."
6. as a reference you can call 'getent passwd non_exisiting_user_name'
this call will return after 5 minites or if
7. kill -CONT $(pidof sssd_be) is called.
Actual result:
[root@client ~]# vi /etc/sssd/sssd.conf
[root@client ~]#
[root@client ~]# systemctl restart sssd
[root@client ~]# kill -STOP $(pidof sssd_be)
[root@client ~]# ./sss_nss_getpwnam_timeout_test test101
Done [5].
[root@client ~]#
Thus on the basis of above observations, marking the bug status "VERIFIED".
Created attachment 1380407 [details]
tar-ball with test build 5 rebased to sssd-1.15.2-50.el7_4.6
Created attachment 1380408 [details]
tar-ball with test build 5 rebased to sssd-1.15.2-50.el7_4.8
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0918 |