freeipa

#8798 RFE: Cache LDAP data within a request
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Request for enhancement

As an IPA administrator I want to limit the number of LDAP searches performed by the IPA framework.

Each IPA command is implemented standalone but some call others (e.g. host-del calls service-del) so there are some repeated executions (like is DNS available). By caching some answers the total number of LDAP searches can be reduced.

The cache does not need to be particularly aggressive. Only single entry searches will need to be cached so:

  • get_entries/find_entries are excluded. Keeping track of all the options plus the cache data would be too cumbersome and probably not pay off.
  • cn=kerberos cannot be cached because kadmin/kadmin.local may operate directly on the data
  • the above is a risk with modifying data directly in LDAP too but is expected to be less
  • the cache is per-request so the size should be relatively small and will refresh on its own. The only risk is a humongous batch command.

https://github.com/freeipa/freeipa/pull/5681

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1953656

Issue linked to Bugzilla: Bug 1953656

master:

  • d1f3ff5506b5ff9bcdc4aa75174cc32f6e4269c6 Call the LDAPClient layer when modifying values
  • 8365d5e734be74b108465abf847160f05aadcb6a Unify installer context to be 'installer'
  • a4675f6f503b153d5adfcfae8c5c1a7a67bdb692 Implement simple LDAP cache layer
  • 3539857ecb156351f3385ddbcab029f22ee4afb4 Add LDAP cache options to the default.conf man page
  • 8d21df93522c7ef76ae03e6b5be303da68420f69 Add a unit test for the LDAP cache layer
  • 1e9a238f358268f23cf359e57038014026fa50b0 Parse the debugging cache log to determine the read savings

ipa-4-9:

  • d6637b2feb2008b4a9538518d5d08a0de79c5a68 Call the LDAPClient layer when modifying values
  • 63767ec067a63811bf73a7314786123b2e89d5ff Unify installer context to be 'installer'
  • b37d679f1dad9fc93f2a8431b4aa62b25f48bcb7 Implement simple LDAP cache layer
  • 00c99cceb43d97a5331e0407337e845c710a51d4 Add LDAP cache options to the default.conf man page
  • 951720d4e66d313c537b003200efc3b33fe4b045 Add a unit test for the LDAP cache layer
  • 0307d222acb8a6c675b985463f56f1071a4e5364 Parse the debugging cache log to determine the read savings

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

performance

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.