document impact of indices and of scope on performance of LDAP queries

[pbrezina]

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 8): Bug 1925621

Description of problem:

The LDAP queries performed with scope=sub can be complex and overload the LDAP
server.
For example, SUDO rules LDAP queries performed with scope=sub over a large
basedn, could cause an unneeded load.

As a reference of the scope, the customer used:
https://ldapwiki.com/wiki/LDAP%20Search%20Scopes

As changing the sssd scope attribute of the LDAP queries would be disruptive
for the running sssd configurations, as the results would change, we would
suggest at least to document the fact that for best performance sssd should be
set with a smaller scope (eg scope=one).

The customer would recommend considering the switch to scope=one in RHEL9 (or
anyway starting with upstream).

Version-Release number of selected component (if applicable):
Any

How reproducible:

Check the documentation

Steps to Reproduce:
1.
2.
3.

Actual results:

The documentation does not report that scope=sub could introduce a performance
issue

Expected results:

The documentation must report that scope=sub could introduce a performance
issue

Additional info:

[pbrezina]

Pushed PR: #5610

• master
  • ca47acc - sudo: add ldap_sudo_random_offset
  • d9d5c29 - sudo: reschedule periodic tasks when full refresh is finished
  • c0204c0 - be: add be_ptask_postpone
  • b3247ee - man: document how to tune sudo performance
  • 61a03b2 - man: document how to disable sudo smart and full refresh