Skip to content

Conversation

@aplopez
Copy link
Contributor

@aplopez aplopez commented Jan 21, 2026

This PR includes:

  • Removal of an unused function.
  • Stop logging a possibly extremely long filter.
  • Fixes a wrong condition invalidating an optimization.
  • Adds a test case for an existing test.

Enumeration, specially when there are 15,000+ users, is slow. This fix helps, but it doesn't work miracles.
In my test environment, the enumeration went from 8 minutes to about 1.

It is important to know that, with such an amount of users, many operations time out. It is necessary to increment the timeout in[nss] and for the domain, but also set large values for ldap_enumeration_refresh_timeout and ldap_search_timeout in the domain. I used these values to avoid any timeout (YMMV):

[domain/ldap.test]
ldap_enumeration_refresh_timeout = 30000
ldap_search_timeout = 6000
timeout = 6000
...

[nss]
timeout = 6000
...

Copy link

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request effectively improves performance by optimizing logging, removing an unused function, and correcting a condition related to enumeration. The changes are well-aligned with the stated goals of enhancing enumeration performance, especially for large user bases. The addition of a new test case for the general enumeration scenario ensures that the modified logic is adequately covered.

@alexey-tikhonov
Copy link
Member

Mistype in the commit message: "We must look into de TS cache"

@aplopez
Copy link
Contributor Author

aplopez commented Jan 22, 2026

Mistype in the commit message: "We must look into de TS cache"

Fixed.

@alexey-tikhonov
Copy link
Member

alexey-tikhonov commented Jan 23, 2026

I think fix is correct in the sense it fixes a bug.

But I think logic of sysdb_enumpwent_filter() can and should be improved in general to avoid a case when dn_filter expands to entire db.

In particular, if addtl_filter isn't set, then sysdb_search_ts_users(enum_filter(NULL)) is expected to return entire db, right? And using this as additional filter results in the same as '*' but extremely slow.
Or do I miss something?

Function sysdb_enumpwent() is not used.
It was replaced by sysdb_enumpwent_filter().
When there are too many users (17,000+) this message can be too long.
Limit it to the first 50 characters.

Resolves: SSSD#6951
We must look into the TS cache only when a name is provided.
Using the TS cache on an unfiltered enumeration is useless.

Resolves: SSSD#6951
Added a case that was not checked before. It is the case
when `attr`, `attr_name` and `addtl_filter` are all `NULL`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants