Bug 1766490
| Summary: | Use negative cache better and domain checks for lookup by SIDs | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Sumit Bose <sbose> |
| Component: | sssd | Assignee: | Tomas Halman <thalman> |
| Status: | CLOSED ERRATA | QA Contact: | shridhar <sgadekar> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 9.1 | CC: | anikandr, atikhono, grajaiya, jhrozek, lslebodn, mzidek, pasik, pbrezina, sebastien.toulmonde, sgadekar, thalman, tscherf |
| Target Milestone: | rc | Keywords: | Improvement, Triaged |
| Target Release: | --- | Flags: | anikandr:
needinfo+
pm-rhel: mirror+ |
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | sync-to-jira | ||
| Fixed In Version: | sssd-2.8.1-1.el9 | Doc Type: | Enhancement |
| Doc Text: |
.Enhance negative cache usage
This update improves the SSSD performance for lookups by Security Identifier (SID). It now stores non-existing SIDs in the negative cache for individual domains and requests the domain that the SID belongs to.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-05-09 08:19:50 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Upstream PR: https://github.com/SSSD/sssd/pull/6353 Pushed PR: https://github.com/SSSD/sssd/pull/6353 * `master` * 5ea1ed27f55508958b21e46a01464f6a3aed11ad - CACHE: implement *get_domain* for SID lookup * 70d5460b0d021e14a84371d367edb67262559713 - CACHE: implement ncache_add_fn for ncache SID Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (sssd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:2514 |
Description of problem: Although the negative cache is checked while processing requests by SIDs it is still not used properly because only a global add function is set in src/responder/common/cache_req/plugins/cache_req_object_by_sid.c but not the add function for individual domains. So if a SID does not exists at all it is added to the negative cache but during a multi-domain search a SID which does not exists in an individual domain is not added to the negative cache of the individual domain. ... .global_ncache_add_fn = cache_req_object_by_sid_global_ncache_add, .ncache_check_fn = cache_req_object_by_sid_ncache_check, .ncache_add_fn = NULL, .ncache_filter_fn = NULL, .lookup_fn = cache_req_object_by_sid_lookup, .dp_send_fn = cache_req_object_by_sid_dp_send, .dp_recv_fn = cache_req_common_dp_recv, .dp_get_domain_check_fn = NULL, .dp_get_domain_send_fn = NULL, .dp_get_domain_recv_fn = NULL, }; ... Additionally, since we already have the *get_domain* check mechanism to go straight to the right domain this should be used for requests by SID as well so that a multi-domain search would only be used as the fallback case.