Red Hat Bugzilla – Bug 1432903
Set GssProxy options to enable caching of ldap tickets
Last modified: 2017-08-01 05:46:16 EDT
When using gssproxy we need to enable syncing back ccaches. This allows the framework to receive back and store (in encrypted form) the ldap/ ticket acquire to talk to the directory server. Without this option each connection to the ldap server will cause a new rountrip to the KDC to acquire a new ldap/ ticket. This will increase the load on both the KDC and DS (to search the principal keys) as well as slow down each operation for the framework.
Upstream ticket: https://pagure.io/freeipa/issue/6771
Needed for IPA to be performant.
Fixed upstream master: https://pagure.io/freeipa/c/4ee7e4ee6d6500d8b8935c9033388adc4cdbe672
Fixed upstream ipa-4-5: https://pagure.io/freeipa/c/62d39385e20b3e1b059466f37cc063833355551e
The difference between the option turned off and turned on is that when the option is turned off each request to the LDAP server requires a roundtripto the KDC to acquire an LDAP ticket, while that is not necessary with the option tunerd on. So to test you can simply compare two runs (before and after) where you use the IPA API (either vina ipa command or via web UI) to perform a number of operations as a specific test user. With the option turned off you should see in krb5kdc.log a request for an ldap/<ipa-server> ticket by 'test' user for each operation. Withthe option turned on you should see only one (or few) request in krb5kdc.log for all operations. HTH.
See instructions above
Verified using IPA version :: ipa-server-4.5.0-14.el7.x86_64 Marking BZ as verified. Performed sanity tests and integration tests for verification. As per Comment #7, seen only single ldap/<server> request for all operations. # tail -f /var/log/krb4kdc.log Jun 06 06:34:13 ipaserver01.testrelm.test krb5kdc[16265](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.19.34.11: ISSUE: authtime 1496744877, etypes {rep=18 tkt=18 ses=18}, HTTP/ipaserver01.testrelm.test@TESTRELM.TEST for ldap/ipaserver01.testrelm.test@TESTRELM.TEST Jun 06 06:34:13 ipaserver01.testrelm.test krb5kdc[16265](info): ... CONSTRAINED-DELEGATION s4u-client=testuser1@TESTRELM.TEST Jun 06 06:34:13 ipaserver01.testrelm.test krb5kdc[16265](info): closing down fd 12
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2304