SSSD / sssd

#3968 krb5_child_init: check_ccache_files() might be *too* slow with large cache
Closed: Fixed by jhrozek. Opened by atikhonov.

Closed: Fixed
Reopen Issue

This commit changed objectclass to objectcategory for users and group and hence removed them from the index.

Now code path krb5_child_init() -> init_renew_tgt() -> check_ccache_files() -> sysdb_search_entry() (== "(&("SYSDB_CCACHE_FILE"=*)("SYSDB_UC"))") might result in a very slow search preventing normal startup of provider.
For details see https://bugzilla.redhat.com/show_bug.cgi?id=1645461

Proposed solutions are:
@sbose : to add an index on the "ccacheFile" attribute to speed this search up
@jhrozek : not use sysdb_base_dn() in check_ccache_files() but use sysdb_user_base_dn() here instead and drop the objectcategory=user clause from the filter

Metadata Update from @atikhonov:
- Custom field rhbz adjusted to 1645461

note that the proposed solutions are not mutually exclusive.

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to 1645461, https://bugzilla.redhat.com/show_bug.cgi?id=1645461 (was: 1645461)

Issue linked to Bugzilla: Bug 1645461

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 2.2

PR: https://github.com/SSSD/sssd/pull/788

Metadata Update from @jhrozek:
- Issue assigned to jhrozek

Metadata Update from @jhrozek:
- Issue tagged with: PR, bug

master:
e474c2d
96013bb
22fc051
sssd-1-16:
e4dd284
7d8b28a
23fb7ea

Metadata Update from @jhrozek:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4941

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata

PR bug

None
None
High
1645461, https://bugzilla.redhat.com/show_bug.cgi?id=1645461
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.