Bug 768159 - IPA Framework causes excessive number of queries against the KDC for ldap tickets
Summary: IPA Framework causes excessive number of queries against the KDC for ldap tic...
Keywords:
Status: CLOSED DUPLICATE of bug 786199
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On:
Blocks: 736854 805270
TreeView+ depends on / blocked
 
Reported: 2011-12-15 22:00 UTC by Dmitri Pal
Modified: 2012-04-16 21:44 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 805270 (view as bug list)
Environment:
Last Closed: 2012-04-16 21:44:12 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Dmitri Pal 2011-12-15 22:00:06 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/1204

While performing bulk level imports I noticed that the IPA Framework causes an excessive number of querying against the KDC for ldap tickets.

When adding lots of sudorule's or hbac rules which require Managed Entry and Compat Plugin interaction, this eventually results in a melting cascade of of the backend ldap daemon followed by the kerberos gssapi pieces, and so on.

This is a serious scalability issue and implementing a better credential cache is strongly desired

Comment 2 Jenny Severance 2012-01-23 16:05:52 UTC
Duplicate bug of ... https://bugzilla.redhat.com/show_bug.cgi?id=669057 ?

Comment 3 Jenny Severance 2012-01-23 16:14:24 UTC
(In reply to comment #2)
> Duplicate bug of ... https://bugzilla.redhat.com/show_bug.cgi?id=669057 ?

https://fedorahosted.org/freeipa/ticket/1336

Comment 4 Rob Crittenden 2012-01-23 16:44:02 UTC
Not a duplicate. Bug 669057 has to do with inefficiencies within the client bootstrap code that was causing a performance bottleneck.

This bug is a server-side issue where if we caching the ldap service ticket would result in a lot less pressure on the KDC.

Comment 5 Jenny Severance 2012-01-30 13:14:59 UTC
Can we get steps to reproduce/ verify please? thanks

Comment 6 Rob Crittenden 2012-01-30 15:04:18 UTC
The average IPA command-line request will generate this activity in the KDC to issue a new ldap service ticket.

Jan 30 09:54:51 rawhide.example.com krb5kdc[21264](info): TGS_REQ (1 etypes {18}) 192.168.166.20: ISSUE: authtime 1327935243, etypes {rep=18 tkt=18 ses=18}, admin@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM
Jan 30 09:54:51 rawhide.example.com krb5kdc[21264](info): TGS_REQ (1 etypes {18}) 192.168.166.20: ISSUE: authtime 1327935243, etypes {rep=18 tkt=18 ses=18}, admin@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM
Jan 30 09:54:52 rawhide.example.com krb5kdc[21264](info): TGS_REQ (4 etypes {18 17 16 23}) 192.168.166.20: ISSUE: authtime 1327935243, etypes {rep=18 tkt=18 ses=18}, admin@EXAMPLE.COM for ldap/rawhide.example.com@EXAMPLE.COM

This happens on each and every request. The load on the ldap server can potentially be even more if IPA is the DNS server.

What you will see once sessions are in place is perhaps a single request that looks like this and then virtually no activity from that user against the KDC.

Comment 7 Martin Kosek 2012-03-30 07:13:20 UTC
This is an upstream ticket for proper session support in CLI:
https://fedorahosted.org/freeipa/ticket/2331

Right now, session support is implemented for WebUI only, it creates a CCACHE when user logs in and does not need further requests to KDC (can be verified in krb5kdc.log).

CLI still sends a request to KDC whenever it is called, but thanks to S4U2 proxy support the activity should be lower:

Mar 30 03:05:53 vm-022.idm.lab.bos.redhat.com krb5kdc[21761](info): TGS_REQ (4 etypes {18 17 16 23}) 10.16.78.22: ISSUE: authtime 1333089161, etypes {rep=18 tkt=18 ses=18}, HTTP/vm-022.idm.lab.bos.redhat.com@IDM.LAB.BOS.REDHAT.COM for ldap/vm-022.idm.lab.bos.redhat.com@IDM.LAB.BOS.REDHAT.COM
Mar 30 03:05:53 vm-022.idm.lab.bos.redhat.com krb5kdc[21761](info): ... CONSTRAINED-DELEGATION s4u-client=admin@IDM.LAB.BOS.REDHAT.COM


Note You need to log in before you can comment on or make changes to this bug.