Bug 768159
| Summary: | IPA Framework causes excessive number of queries against the KDC for ldap tickets | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Dmitri Pal <dpal> | |
| Component: | ipa | Assignee: | Rob Crittenden <rcritten> | |
| Status: | CLOSED DUPLICATE | QA Contact: | IDM QE LIST <seceng-idm-qe-list> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 6.3 | CC: | jgalipea, mkosek | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 805270 (view as bug list) | Environment: | ||
| Last Closed: | 2012-04-16 21:44:12 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 736854, 805270 | |||
|
Description
Dmitri Pal
2011-12-15 22:00:06 UTC
Duplicate bug of ... https://bugzilla.redhat.com/show_bug.cgi?id=669057 ? (In reply to comment #2) > Duplicate bug of ... https://bugzilla.redhat.com/show_bug.cgi?id=669057 ? https://fedorahosted.org/freeipa/ticket/1336 Not a duplicate. Bug 669057 has to do with inefficiencies within the client bootstrap code that was causing a performance bottleneck. This bug is a server-side issue where if we caching the ldap service ticket would result in a lot less pressure on the KDC. Can we get steps to reproduce/ verify please? thanks The average IPA command-line request will generate this activity in the KDC to issue a new ldap service ticket.
Jan 30 09:54:51 rawhide.example.com krb5kdc[21264](info): TGS_REQ (1 etypes {18}) 192.168.166.20: ISSUE: authtime 1327935243, etypes {rep=18 tkt=18 ses=18}, admin for krbtgt/EXAMPLE.COM
Jan 30 09:54:51 rawhide.example.com krb5kdc[21264](info): TGS_REQ (1 etypes {18}) 192.168.166.20: ISSUE: authtime 1327935243, etypes {rep=18 tkt=18 ses=18}, admin for krbtgt/EXAMPLE.COM
Jan 30 09:54:52 rawhide.example.com krb5kdc[21264](info): TGS_REQ (4 etypes {18 17 16 23}) 192.168.166.20: ISSUE: authtime 1327935243, etypes {rep=18 tkt=18 ses=18}, admin for ldap/rawhide.example.com
This happens on each and every request. The load on the ldap server can potentially be even more if IPA is the DNS server.
What you will see once sessions are in place is perhaps a single request that looks like this and then virtually no activity from that user against the KDC.
This is an upstream ticket for proper session support in CLI: https://fedorahosted.org/freeipa/ticket/2331 Right now, session support is implemented for WebUI only, it creates a CCACHE when user logs in and does not need further requests to KDC (can be verified in krb5kdc.log). CLI still sends a request to KDC whenever it is called, but thanks to S4U2 proxy support the activity should be lower: Mar 30 03:05:53 vm-022.idm.lab.bos.redhat.com krb5kdc[21761](info): TGS_REQ (4 etypes {18 17 16 23}) 10.16.78.22: ISSUE: authtime 1333089161, etypes {rep=18 tkt=18 ses=18}, HTTP/vm-022.idm.lab.bos.redhat.com.BOS.REDHAT.COM for ldap/vm-022.idm.lab.bos.redhat.com.BOS.REDHAT.COM Mar 30 03:05:53 vm-022.idm.lab.bos.redhat.com krb5kdc[21761](info): ... CONSTRAINED-DELEGATION s4u-client=admin.BOS.REDHAT.COM |