freeipa

#7004 Slow ldapsearch after upgrade from 4.2 to 4.4 (Directory manager is still fast)
Closed: invalid Opened by zacekm.

Closed: invalid
Reopen Issue

Hi,
we have Samba server with GPFS and IPA as LDAP backend. After we have updated to version 4.4 first login to Samba shares is very slow (more then one minute). I was able to find "bad" LDAP search which causes it and test it from command line with ldapsearch. The strange thing is that with Directory manager query is fast (about 1 second), but with admin or any "normal" user query takes more then 40 second in test environment and more them minute in production.

Log from "/var/log/dirsrv/slapd-IMG-LOCAL/access" and ldapsearch with filter attached.
ipa-server-4.4.0-14.el7.centos.7.x86_64

Your help would be appreciated.
Thanks,
Michal
access_log.txt

And ldapsearch ;-)
ldapsearch.txt

You seem to have own schema extension added but didn't add indexes for the attributes from the extended schema. In particular, sambaSIDList is unindexed and thus causes slow searches.

You need to create an update file to add indexes:

dn: cn=sambaSIDList,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
default:cn: sambaSIDList
default:ObjectClass: top
default:ObjectClass: nsIndex
default:nsSystemIndex: false
default:nsIndexType: eq
default:nsIndexType: pres
default:nsIndexType: sub

copy this file to /usr/share/ipa/updates/89-sambasidlist-indices.update and run ipa-server-upgrade.
Edited by abbra

note that above rendering is effected by the pagure's support for emojis. I'll add a file instead.

89-sambasidlist-indices.update

Let me know if this helps. I'll close this bug as invalid because it does not affect a default FreeIPA distribution.

Hi abbra,

it helped, now search takes 0.2 second ;-)
Thank you very match.

Michal

Ok, great. Closing the bug.

Metadata Update from @abbra:
- Issue assigned to abbra
- Issue close_status updated to: invalid
- Issue priority set to: trivial
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Highest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.