Ticket #1063 (closed enhancement: fixed)

Opened 2 years ago

Last modified 2 years ago

Improve initgroups() performance for ssh and similar services

Reported by: sbose Owned by: sgallagh
Priority: major Milestone: SSSD 1.7.0
Component: PAM Version: 1.6.2
Keywords: Cc:
Blocked By: Blocking:
Tests Updated: no Coverity Bug:
Patch Submitted: yes Red Hat Bugzilla: 0
Design link:
Feature Milestone:
Design review: Fedora test page:
Chosen: Candidate to push out:
Release Notes:

Description

Currently sssd records in a client session if an online initgroups() call was already done and does not run a second online call if the last one falls in a timeout.

sshd and maybe other services uses two different PAM sessions, one for authentication and authorization and a second one for the session setup. Form the sssd perspective these are two different client sessions and two online initgroups() calls are preformed for a single ssh connection. As far as I know it is not possible to to related the two PAM session.

To improve the performance here I would like to suggest to save the time of the last initgroups() call for a user not only in the client context, but additionally in a global context. This way critical task like authentication, access control and maybe password changes can still check the timeout of the client context to make sure the initgroups() is at least done once online with this session is run. Other task can check the global timeout and can use that data which is stored by other sessions if it is not too old.

Change History

comment:1 Changed 2 years ago by dpal

  • Milestone changed from NEEDS_TRIAGE to SSSD 1.8.0

comment:2 Changed 2 years ago by dpal

  • Milestone changed from SSSD 1.8.0 to SSSD 1.7.0

comment:3 Changed 2 years ago by dpal

  • Owner changed from somebody to jhrozek

comment:4 Changed 2 years ago by jzeleny

  • Owner changed from jhrozek to jzeleny

comment:5 Changed 2 years ago by dpal

  • Owner changed from jzeleny to sgallagh

comment:6 Changed 2 years ago by sgallagh

  • Patch Submitted set

comment:7 Changed 2 years ago by sgallagh

  • Status changed from new to assigned

comment:8 Changed 2 years ago by sgallagh

  • Resolution set to fixed
  • Status changed from assigned to closed

comment:9 Changed 2 years ago by sgallagh

comment:10 Changed 2 years ago by sgallagh

  • Red Hat Bugzilla set to 0
Note: See TracTickets for help on using tickets.