[Freeipa-devel] [PATCH] 492 Add options to reduce writes from KDC

[Simo Sorce]

On Mon, 2012-06-04 at 22:59 -0400, Rob Crittenden wrote:
> Simo Sorce wrote:
> > The original ldap driver we used up to 2.2 had 2 options admins could
> > set to limit the amount of writes to the database on certain auditing
> > related operations.
> > In particular disable_last_success is really important to reduce the
> > load on database servers.
> >
> > I have implemented ticket #2734 with a little twist. Instead of adding
> > local options in krb5.conf I create global options in the LDAP tree, so
> > that all KDCs in the domain have the same configuration.
> >
> > The 2 new options can be set in ipaConfigString attribute of the
> > cn=ipaConfig object under cn=etc,$SUFFIX
> >
> > These are:
> > KDC:Disable Last Success
> > KDC:Disable Lockout
> >
> > The first string if set will disable updating the krbLastSuccessfulAuth
> > field in the service/user entry.
> > The second one will prevent changing any of the Lockout related fields
> > and will effectively disable lockout policies.
> >
> > I think we may want to set the first one by default in future.
> > The last successful auth field is not very interesting in general and is
> > cause for a lot of writes that pressure a lot the LDAP server and get
> > replicated everywhere with a storm multiplier effect we'd like to avoid.
> >
> > The lockout one instead happen only when there are failed authentication
> > attempt, this means it never happens when keytabs are used for example.
> > And even with users it should happen rarely enough that traking lockouts
> > by default make leaving these writes on by default is a good tradeoff.
> >
> > Note that simply setting the lockout policy to never lockout is *not*
> > equivalent to setting KDC:Disable Lockout, as it does not prevent writes
> > to the database.
> >
> > I've tested setting KDC:Disable Last Success and it effectively prevent
> > MOD operation from showing up in the server access log.
> >
> > Any change to these configuration options requires a reconnection from
> > the KDC to the LDAP server, the simplest way to cause that is to restart
> > the KDC service.
> >
> > Simo.
> 
> In ipadb_get_global_configs() should there be a call to LOG_OOM()?
> 
> Also, if ipadb_simple_search() or ipadb_get_global_configs() fails 
> should we log the result code when non-zero?

Well this code runs in the KDC, not in DIRSRV so LOG_OOM() wouldn't
work.
Perhaps we should add KDC_LOG() macros, but that would be a separate
task imo.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York