nsds5replicabinddngroupcheckinterval current defaults to -1. This means the binddn group contents are only read at startup or configuration.
However, this means live changes to the groupdn may not be reflected: As a result additions to the group, or importantly removals are not respected.
This may represent a case for a customer where they can't update their replicas only, or they may not realise the groups are not checked live, and decommisioning a compromised server may have it's credentials still able to access replication.
Setting this to 0 means we would check the group membership "each bind", which gives consistent and predictable results.
@firstyear, I agree that -1 has a severe drawback. Now replica_updatedn_list_group_replace may have a performance impact loading the members of the allowed groups. As it is done within the bind of the replica agreement, it can delay the bind.
Metadata Update from @tbordaz: - Custom field component adjusted to None - Custom field origin adjusted to None - Custom field reviewstatus adjusted to None - Custom field type adjusted to None - Custom field version adjusted to None
To bind we have to retrieve the entry anyway .... and retrieving a single group by DN should be very fast. I'm not sure the delay would be significant in contrast to the other behaviour of the replication system?
389-ds-base is moving from Pagure to Github. This means that new issues and pull requests will be accepted only in 389-ds-base's github repository.
This issue has been cloned to Github and is available here: - https://github.com/389ds/389-ds-base/issues/2556
If you want to receive further updates on the issue, please navigate to the github issue and click on subscribe button.
subscribe
Thank you for understanding. We apologize for all inconvenience.
Metadata Update from @spichugi: - Issue close_status updated to: wontfix - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.