[Freeipa-devel] [PATCH] 492 Add options to reduce writes from KDC

[Simo Sorce]

The original ldap driver we used up to 2.2 had 2 options admins could
set to limit the amount of writes to the database on certain auditing
related operations.
In particular disable_last_success is really important to reduce the
load on database servers.

I have implemented ticket #2734 with a little twist. Instead of adding
local options in krb5.conf I create global options in the LDAP tree, so
that all KDCs in the domain have the same configuration.

The 2 new options can be set in ipaConfigString attribute of the
cn=ipaConfig object under cn=etc,$SUFFIX

These are:
KDC:Disable Last Success
KDC:Disable Lockout

The first string if set will disable updating the krbLastSuccessfulAuth
field in the service/user entry.
The second one will prevent changing any of the Lockout related fields
and will effectively disable lockout policies.

I think we may want to set the first one by default in future.
The last successful auth field is not very interesting in general and is
cause for a lot of writes that pressure a lot the LDAP server and get
replicated everywhere with a storm multiplier effect we'd like to avoid.

The lockout one instead happen only when there are failed authentication
attempt, this means it never happens when keytabs are used for example.
And even with users it should happen rarely enough that traking lockouts
by default make leaving these writes on by default is a good tradeoff.

Note that simply setting the lockout policy to never lockout is *not*
equivalent to setting KDC:Disable Lockout, as it does not prevent writes
to the database.

I've tested setting KDC:Disable Last Success and it effectively prevent
MOD operation from showing up in the server access log.

Any change to these configuration options requires a reconnection from
the KDC to the LDAP server, the simplest way to cause that is to restart
the KDC service.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-simo-492-1-Add-support-for-disabling-KDC-writes.patch
Type: text/x-patch
Size: 6815 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20120525/a962cfcb/attachment.bin>