Description of problem:
Client is trying to implement a HBAC rule for a big host_group - around 2500+ hosts.
After trying to add a bunch of new hosts to the group, IPA hangs for some time, possibly because it tries to iterate all memberof plugin tasks.
After some time - after adding 1000 hosts to a 1000 host group it was around 1 hour - the IPA becomes responsive back. The IPA's host systems are intact all the time.
We've tried to capture strace of dirserv, sosreport and atop from the system, you can find them in the case attached.
Version-Release number of selected component (if applicable):
389-ds-base-184.108.40.206-14.el7_8.x86_64 Mon Aug 31 23:07:33 2020
ipa-server-4.6.6-11.el7.x86_64 Mon Aug 31 23:08:07 2020
- not enough hosts in lab env to reproduce
IPA is hung fro long time and can't serve clients at all
IPA remains responsive, or processing takes significantly less time
The case owner asked for the following in the case and the customer has provided a response:
Can we take a look at the current HBAC rule -
# ipa hbacrule-find <rule name>
1 HBAC rule matched
Rule name: unix-admins_hbac
Host category: all
Service category: all