SSSD / sssd

#2478 Provide sss_nss_* API to directly query SSSD instead of nsswitch.conf route
Closed: Fixed Opened by abbra.

Closed: Fixed
Reopen Issue

For FreeIPA integration with Active Directory, we need to expose information about AD users and groups to legacy clients via LDAP. Currently slapi-nis plugin requests information from glibc's NSS API and while all requests are about SSSD-provided users and groups, the whole stack of modules from nsswitch.conf must be traversed.

When answering membership queries "(&(memberUid=user@ad.domain)(objectClass=posixGroup))", slapi-nis has to build full group entries for all groups a user is a member of. For large groups this also means pulling a lot of group members. When going through glibc's NSS API, for every request to SSSD there is also a request to nss_files which eventually causes dead locks because nss_files serializes own access to /etc/group and /etc/passwd which gets into a way for normal NSS requests from 389-ds process consisting of multiple threads.

As result, when AD groups contain several hundred or thousands members, it is easy to get nss_files to dead lock itself, visible as 100% CPU bound ns-slapd process.

Ideally we want to avoid hitting anything but SSSD with these queries because we already know that only SSSD can provide the requested information.

slapi-nis already uses sss_nss_getXXbyYY() API. We can use sss_nss_getorigbyname() as well but it only returns a restricted set of key:value pairs that is not enough to fully support slapi-nis use cases.

It would be good to have an extension of sss_nss_getXXbyXX() API that provides the same information as getpwnam_r(), getgrnam_r(), getgrgid_r(), getgroups calls from glibc's API.

Additionally, information about group membership and user membership in different groups would need to be cached in memory for such cases where getgroups() calls are used to populate membership information.

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.13 beta
priority: major => blocker

Fields changed

rhbz: => todo

I'm temporarily moving this ticket to 1.13 backlog. We identified several pain points of sssd's server mode performance last week during face-to-face meetings, but we will first explore enlarging the memory caches, adding an initgroups memory cache and checking out some mutex issues.

milestone: SSSD 1.13 beta => SSSD 1.13 backlog
priority: blocker => minor

Mass-moving tickets not planned for the next two releases.

Please reply with a comment if you disagree about the move..

milestone: SSSD 1.13 backlog => SSSD 1.15 beta

Metadata Update from @abbra:
- Issue set to the milestone: SSSD Future releases (no date set yet)

commits in master:
859bddc2bf51dc426a3dc56bd9f365e9c5722b65
e54db68cbb9c12d8a6867f2c7766fb2115ab0997
85da8a5e90bffc8b0fef5e0ea364a8d3cb50de86
55f7d8034d783c01789d76a2b9ffc901045e8af8
a7d6ca275d6b2e5d396cbefb18d0ee880011e271
52e675ec4b160720515c81ae8c0e5a95feb50c57
ac6b267ff3df6d0417062a128ec16b184ea2c1b7
cf93f7c2f2031078bbbff095dae01eb4f8deff85
5e6622722e84d594298a8324f3685a1bda2b5868
7449b236523409cc8766fb957d6cba051fdfb483

Metadata Update from @jhrozek:
- Custom field design_review reset (from 0)
- Custom field mark reset (from 0)
- Custom field patch reset (from 0)
- Custom field review reset (from 0)
- Custom field testsupdated reset (from 0)
- Issue close_status updated to: None

Metadata Update from @jhrozek:
- Custom field design_review reset (from false)
- Custom field mark reset (from false)
- Custom field patch reset (from false)
- Custom field review reset (from false)
- Custom field testsupdated reset (from false)
- Issue assigned to sbose
- Issue close_status updated to: Fixed
- Issue set to the milestone: SSSD 1.16.1 (was: SSSD Future releases (no date set yet))
- Issue status updated to: Closed (was: Open)

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1473571 (was: todo)

Issue linked to Bugzilla: Bug 1473571

master:

  • bba068c535d23eebff61f592bddb3a6438446d6f

Metadata Update from @lslebodn:
- Custom field design_review reset (from false)
- Custom field mark reset (from false)
- Custom field patch reset (from false)
- Custom field review reset (from false)
- Custom field testsupdated reset (from false)

additional patch

master:

  • 3e32cb2ad36a9dd2654c7f63469dc595f1bb8593

additional fix found by covscan
master:

  • 1d88a0591ce8445ea3b6a88845a5997d61c915b4
Edited by lslebodn

Metadata Update from @jhrozek:
- Custom field design_review reset (from false)
- Custom field mark reset (from false)
- Custom field patch reset (from false)
- Custom field review reset (from false)
- Custom field testsupdated reset (from false)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3520

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
High
false
false
false
false
false
defect
SSSD
1.12.2
https://bugzilla.redhat.com/show_bug.cgi?id=1473571
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.