dogtagpki

#1450 pki cert-find could be time consuming: create upgrade framework to upgrade VLV for existing installations
Closed: Invalid Opened by mharmsen.

Closed: Invalid
Reopen Issue

"ipa cert-find" and "pki cert-find" commands with no additional parameters could be very time consuming if there are too many certificates.

The problem is that the query the commands are doing to the dirsrv instance is not matching any exisiting vlvindex. So, the query is unindexed.

Steps to Reproduce:

do "pki cert-find" and see the access logs. We should find something like:
[09/Jun/2015:16:05:09 +0200] conn=7 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI
[09/Jun/2015:16:05:09 +0200] conn=7 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=admin,cn=users,cn=accounts,dc=example,dc=org"
[09/Jun/2015:16:05:09 +0200] conn=7 op=3 SRCH base="cn=ipaconfig,cn=etc,dc=example,dc=org" scope=0 filter="(objectClass=*)" attrs=ALL
[09/Jun/2015:16:05:09 +0200] conn=7 op=3 RESULT err=0 tag=101 nentries=1 etime=0
[09/Jun/2015:16:05:09 +0200] conn=7 op=4 SRCH base="cn=masters,cn=ipa,cn=etc,dc=example,dc=org" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL
[09/Jun/2015:16:05:09 +0200] conn=7 op=4 RESULT err=0 tag=101 nentries=2 etime=0
[09/Jun/2015:16:05:09 +0200] conn=3 op=7 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(&(serialno=*))" attrs=ALL
[09/Jun/2015:16:05:09 +0200] conn=3 op=7 SORT serialno (14)
[09/Jun/2015:16:05:09 +0200] conn=3 op=7 VLV 0:10:A 14:14 (0)
[09/Jun/2015:16:05:09 +0200] conn=3 op=7 RESULT err=0 tag=101 nentries=1 etime=0 notes=U
[09/Jun/2015:16:05:09 +0200] conn=3 op=8 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(&(serialno=*))" attrs=ALL
[09/Jun/2015:16:05:09 +0200] conn=3 op=8 SORT serialno (14)
[09/Jun/2015:16:05:09 +0200] conn=3 op=8 VLV 0:10:0:14 1:14 (0)
[09/Jun/2015:16:05:09 +0200] conn=3 op=8 RESULT err=0 tag=101 nentries=11 etime=0 notes=U
[09/Jun/2015:16:05:10 +0200] conn=3 op=9 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(&(serialno=*))" attrs=ALL
[09/Jun/2015:16:05:10 +0200] conn=3 op=9 SORT serialno (14)
[09/Jun/2015:16:05:10 +0200] conn=3 op=9 VLV 0:10:10:14 11:14 (0)
[09/Jun/2015:16:05:10 +0200] conn=3 op=9 RESULT err=0 tag=101 nentries=4 etime=1 notes=U
[09/Jun/2015:16:05:10 +0200] conn=7 op=5 UNBIND
[09/Jun/2015:16:05:10 +0200] conn=7 op=5 fd=92 closed - U1
all the searches showing "notes=U"
The query 
base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(&(serialno=*))"
is not matching any vlvindex.

Additional info:

Workaround is to add a new vlvindex like this:
---------------------------------------------------------
dn: cn=allCertsSerial-pki-tomcat,cn=ipaca,cn=ldbm database,cn=plugins,cn=config
objectClass: top
objectClass: vlvSearch
vlvFilter: (&(serialno=*))
vlvScope: 1
vlvBase: ou=certificateRepository,ou=ca,o=ipaca
cn: allCertsSerial-pki-tomcat
numSubordinates: 1
dn: cn=allCertsSerial-pki-tomcatIndex,cn=allCertsSerial-pki-tomcat,cn=ipaca,cn=ldbm database,cn=plugins,cn=config
vlvUses: 0
vlvEnabled: 0
vlvSort: serialno
objectClass: top
objectClass: vlvIndex
cn: allCertsSerial-pki-tomcatIndex
-------------------------------------------------------------
+ apply it:
/var/lib/dirsrv/scripts-EXAMPLE-ORG/vlvindex -n ipaca -T  allCertsSerial-pki-tomcatIndex

The problem was fixed in #1449 without requiring database changes.

Metadata Update from @mharmsen:
- Issue assigned to edewata
- Issue set to the milestone: UNTRIAGED

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2010

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Normal
None
None
None
None
None
defect
Tools
IPA
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.