SSSD / sssd

#3619 Enable local_negative_timeout by default
Closed: Fixed Opened by jhrozek.

Closed: Fixed
Reopen Issue

I think we could enable the local negative timeout by default. In case there is no files domain, there is no reason sssd should be looking up local users except the libc merging feature, but then the entry with the same name should exist in LDAP and the negative cache is only called if the entry is not found.

If the files domain is enabled, the entry would be found in the files domain and not saved to the negative cache.

I think a reasonable default should be a couple of hours.

IMHO we might also take an advantage of files domain and replace getpwnam_r/getgrnam_r with internal functions

https://pagure.io/SSSD/sssd/blob/master/f/src/responder/common/negcache_files.c#_44
https://pagure.io/SSSD/sssd/blob/master/f/src/responder/common/negcache_files.c#_62
https://pagure.io/SSSD/sssd/blob/master/f/src/responder/common/negcache_files.c#_86
https://pagure.io/SSSD/sssd/blob/master/f/src/responder/common/negcache_files.c#_104

Which internal function do you have in mind? The nss_ex_ API? When this feature was introduced, we considered dlopening nss_files and calling the functions directly. I don't know why we didn't go with this after all, but in general I agree that using the NSS API directly is a bit risky, because you never know what kind of malfunctioning module there might be.

On (18/01/18 12:21), Jakub Hrozek wrote:

Which internal function do you have in mind? The nss_ex_ API? When this feature was introduced, we considered dlopening nss_files and calling the functions directly. I don't know why we didn't go with this after all, but in general I agree that using the NSS API directly is a bit risky, because you never know what kind of malfunctioning module there might be.

I meant directly use sysdb internal function with files domain.

LS

Ah, this would work, because the files domain enumerates. Good idea.

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.2

Metadata Update from @jhrozek:
- Issue priority set to: major

https://github.com/SSSD/sssd/pull/589

Metadata Update from @jhrozek:
- Issue assigned to jhrozek

Metadata Update from @jhrozek:
- Issue tagged with: PR

master:
9adc750

Metadata Update from @fidencio:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4640

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata

PR

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.