MIME-Version: 1.0
Message-ID: <d02806d5-b981-4f28-87df-5a9bb3d9908c@default>
Date: Thu, 23 Oct 2014 12:13:21 -0700 (PDT)
From: Tsu-Phong Wu <tsu-phong.wu@oracle.com>
To: <rt-comment@krbdev.mit.edu>
Subject: Re: [krbdev.mit.edu #8027] Client RPC timeout during kadmin listprincs command
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
RT-Send-Cc: 
Content-Length: 1288

Thanks for the reply.

Our current version is 1.8.6 (and an older version 1.4 something) and apparently we'll have issues there.

Is there a bug# on this LDAP KDB performance and do you happen to know how big the effort is to port it to pre-1.9?

Thanks.
Tsu-Phong

----- Original Message -----
From: rt-comment@krbdev.mit.edu
Sent: Tuesday, October 21, 2014 11:44:54 AM GMT -08:00 US/Canada Pacific
Subject: [krbdev.mit.edu #8027] Client RPC timeout during kadmin listprincs command

Before we commit to changing the default or making it configurable, I would 
like to know what version of Kerberos is being used on the back end.  Prior 
to release 1.9, the LDAP KDB module takes O(N^2) time to iterate over N 
principals due to a combination of questionable design features.  It is 
possible that retrieving even a hundred thousand principal names could be 
done in less than 120 seconds without this bug.

If we do need to make a change, I would suggest using a very long timeout 
or (if possible) disable the timeout entirely.  Since kadmin runs over TCP, 
there isn't really a strong need to time out if kadmind takes a long time 
to respond.
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs