Winbind slowing down entire system

[Tim Potter]

Gerald Carter writes:

> > I have had the same trouble.  I traced it to login getting group
> > information.  When trying to find out what groups a user belongs to, login
> > gets a list of _all_ the groups the system is aware of.  On a domain with
> > 12000 users and 14000 groups, it was taking 1 minute or more to come back
> 
> Yup this would be a problem.  winbindd views all domain groups to
> see which ones the user is a member of IIRC.
> 
> Tim, am I wrong?  Need to check the code.  We should probably
> cache domain groups more.  Since a RID cannot be reused under NT
> this is not a problem.  What do you think?

Even if you cache all domain groups there is still the problem of
getting them in the first place.  It's going to be slow whatever
happens.  

If you go through the source code for login (at least it did when
I last looked at it) enumerating all the groups was only needed
for determining which groups a user was a member of.  Some
versions of glibc on linux have a initgroups() NSS call which is
called instead of going through an entire
setgrent()/getgrent()/endgrent() cycle. 

So if you can get the source code to the version of login you are
using work out why it is fetching so many group entries, you can
fix it.

Interestingly enough, some old C libraries implement initgroups()
in terms of setgrent()/getgrent()/endgrent() which is quite stupid.


Tim.