We've had problems with SSSD being slow sometimes, but not others (probably only slow whenver it's caches expired?), and there never seemed to be any obvious cause why, but I think I've tracked it down to problems with dereferencing. We do see errors about dereferencing in the log, but I didn't realize until now what it was referring to - due to how our SSD configuration sections were named, I thought it was a Kerberos issue for a long time...
In theory, a search like this should give us the cn and objectclass of all members of the group, but I get only the attributes of the group itself. Whether I give the "-E 'deref=...'" or not I get the same output. Redacted output below:
ldapsearch [bind username and password stuff, etc] -E 'deref=uniqueMember:cn,objectclass' 'cn=Global System Administrators'
# extended LDIF
# base <[our base DN]> (default) with scope subtree
# filter: cn=Global System Administrators
# requesting: ALL
# with dereference control
# Global System Administrators, Groups, [our base DN]
dn: cn=Global System Administrators,ou=Groups,[our base DN]
control: 188.8.131.52.4.1.4203.666.5.16 false MIQAAAAA
uniqueMember: uid=user1,ou=Users,ou=[Office1],[our base DN]
uniqueMember: uid=user2,ou=Users,ou=[Office2],[our base DN]
uniqueMember: uid=user3,ou=Users,ou=[Office2],[our base DN]
uniqueMember: uid=user4,ou=Users,ou=[Office1],[our base DN]
cn: Global System Administrators
description: Global System Administrators
# search result
result: 0 Success
# numResponses: 2
# numEntries: 1
I posted this to the 389-ds-user-list and Ludwig Krispenz responded and said I should open a ticket, and that if we had performed the query with the control specified as critical "-E '!deref=....' we would get an error the the deref attr needs to be of dn syntax. I did try that, and indeed, it said "A dereference attribute must have DN syntax". Per Ludwig Krispenz, "in 389 ds uniquemember is specified as 'Name and Optional UID' syntax, which is dn [#UID], but the deref plugin just checks for dn syntax."
no cloning, upstream tests can cover this.
git patch file (master)
I have tested without and with the patch and can confirm that it corrects the behaviour for the query with "-E 'deref=uniqueMember:cn,objectclass'".
Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1256938
Reviewed by Mark (Thanks!!)
Pushed to master:
5fe2892..2dbbb9d master -> master
Pushed to 389-ds-base-1.3.4:
19b0d4a..626f2d7 389-ds-base-1.3.4 -> 389-ds-base-1.3.4
Metadata Update from @nhosoi:
- Issue assigned to lkrispen
- Issue set to the milestone: 1.3.4 backlog
to comment on this ticket.