[autobackport: sssd-2-9] memberOf plugin: avoid ldb_dn_compare() in mbof_append_addop()

[sssd-bot]

This is an automatic backport of PR#8546 memberOf plugin: avoid ldb_dn_compare() in mbof_append_addop() to branch sssd-2-9, created by @alexey-tikhonov.

Please make sure this backport is correct.

Note

The commits were cherry-picked without conflicts.

You can push changes to this pull request

git remote add sssd-bot git@github.com:sssd-bot/sssd.git
git fetch sssd-bot refs/heads/SSSD-sssd-backport-pr8546-to-sssd-2-9
git checkout SSSD-sssd-backport-pr8546-to-sssd-2-9
git push sssd-bot SSSD-sssd-backport-pr8546-to-sssd-2-9 --force

---

Original commits
2dcdca2 - memberOf plugin: avoid ldb_dn_compare() in mbof_append_addop()

Backported commits

• 87e0256 - memberOf plugin: avoid ldb_dn_compare() in mbof_append_addop()

---

Original Pull Request Body

Justification is the same as in 704c31d
In certain scenarios this function is a hot path and using heavy ldb_dn_compare() adds unnecessary overhead.

Testing with a following setup: 50 mid-level groups that all share the same 2500 leaf groups as members, plus one top-level group containing all mid-level groups. Each leaf group contains a single user. ignore_group_members = false.
time id user with a cold cache:

• using SDAP: reduce logger load in the hot paths #8540 as "vanilla" build: ~20.7..21.5 secs, mbof_append_addop() accounts for ~35%
• using build from this PR: ~16.0..17.5 secs, mbof_append_addop() accounts for ~18%

i.e. this patch makes mbof_append_addop() approx x2 faster (this gain doesn't depend on number of groups; but weight of mbof_append_addop() in total consumption depends on it)

[gemini-code-assist]

Code Review

This pull request moves the sss_linearized_dn_match function to an earlier position in src/ldb_modules/memberof.c and updates mbof_append_addop to use it for DN comparisons instead of ldb_dn_compare. It also introduces a null check for the linearized DN to improve robustness. I have no feedback to provide.

[aplopez]

ACK

[sssd-bot]

The pull request was accepted by @alexey-tikhonov with the following PR CI status:

---

🟢 CodeQL (success)
🟢 rpm-build:centos-stream-9-x86_64:upstream (success)
🟢 Build / make-distcheck (success)
🟢 ci / prepare (success)
🟢 ci / system (centos-9) (success)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.