freeipa

#8321 RFE: Stop computing has_password and has_keytab for all entries
Opened by rcritten. Modified

Open
Close Issue

Request for enhancement

Doing the has_keytab and has_password queries for users and hosts in the *-show command has a measurable performance impact. Investigate the reasons that these are always retrieved and consider protecting them with a permission instead, providing only with --all or a new option.

Investigate the history of these to determine if they are there "because we can" or due to some other reason(s).

Changing this behavior could be considered a regression so perhaps also add a global option to always enable it to restore previous behavior.

Related performance ticket: https://pagure.io/freeipa/issue/8134

Possible solutions are also:

  • Create a server control to allow querying for the presence of an attribute.
  • Add operational attributes that indicate the presence of userpassword and krbprincipalkey attributes.

Both proposals require writing non-trivial 389-DS plugins in C -- something we'd rather avoid.
Metadata
None

performance

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.