idp: do not update cache timeout if member is added#8545
Conversation
|
Hi, with respect to #8330 this PR only solves the bye, |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new configuration option, avoid_id_lookups, for SSSD domains. This option, which defaults to true for IdP providers, enables SSSD to optimize lookups by attempting to fall back to name-based searches when an ID-based lookup is performed and a cached object with a matching ID is found, thereby avoiding potentially expensive ID lookups on the backend. The changes include adding the configuration option to the domain structure, implementing the fallback logic in cache request processing, updating configuration files and documentation, and adding a new system test for IdP provider behavior. Additionally, an optimization was made in the IdP provider to prevent resetting group cache timeouts when only a single member is added. There are no review comments to address.
|
|
dffbcd0 to
2cdb7c6
Compare
|
Imo, option name |
|
"If this new option option is set ..." -- double 'option' in the commit message. |
|
Commit message: "Resolve: #8330" -> "Resolves ..." |
2cdb7c6 to
4808cf1
Compare
Hi, I changed this in the latest version. bye, |
fixed |
fixed |
|
Thank you for the updates. |
alexey-tikhonov
added
backport-to-sssd-2-12
and removed
no-backport
4808cf1 to
01c5bbd
Compare
|
ACK |
If this new option is set to 'true' SSSD will try to avoid sending
lookups by ID to the backend and will switch to a lookup by name if a
cached object with a matching ID can be found. This option can e.g. be
used in cases where searches by ID are expensive on the server side
because of missing indexes or are not even possible.
:config: New option 'avoid_by_id_lookups' to tell the SSSD responders to
use a lookup by name instead of by id where possible
Resolves: SSSD#7668
Reviewed-by: Alexey Tikhonov <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
If 'avoid_by_id_lookups' is set to 'True' switch to a lookup by name if a user or a group is searched by ID. Resolves: SSSD#7668 Reviewed-by: Alexey Tikhonov <[email protected]> Reviewed-by: Pavel Březina <[email protected]>
If only a single member is added to a group, e.g. during an initgroups request, do not increment the cache timeout because it is not clear if the list of members is complete or not. Resolves: SSSD#8330 Reviewed-by: Alexey Tikhonov <[email protected]> Reviewed-by: Pavel Březina <[email protected]>
01c5bbd to
4cef39a
Compare
4 participants
If only a single member is added to a group, e.g. during an initgroups
request, do not increment the cache timeout because it is not clear if
the list of members is complete or not.
Resolve: #8330
conf: add avoid_id_lookups domain option
If this new option option is set to 'true' SSSD will try to avoid
sending lookups by ID to the backend and will switch to a lookup by name
if a cached object with a matching ID can be found. This option can
e.g. be used in cases where searches by ID are expensive on the server
side because of missing indexes or are not even possible.
:config: New option 'avoid_id_lookups' to tell the SSSD responders to
use a lookup by name instead of by id where possible
Resolves: #7668