Tuning performance in Identity Management

Procedure

1. Identify the redundant CA service and follow the procedure in Uninstalling an IdM server on the IdM replica that hosts this service.
2. On the same host, follow the procedure in Installing an IdM server: With integrated DNS, without a CA.

Procedure

1. To display current search time and size limits in CLI, use the ipa config-show command:

   $ ipa config-show
   
   Search time limit: 2
   Search size limit: 100

2. To adjust the limits globally for all queries, use the ipa config-mod command and add the --searchrecordslimit and --searchtimelimit options. For example:

   $ ipa config-mod --searchrecordslimit=500 --searchtimelimit=5

3. To temporarily adjust the limits only for a specific query, add the --sizelimit or --timelimit options to the command. For example:

   $ ipa user-find --sizelimit=200 --timelimit=120

Procedure

1. Log in to the IdM Web UI.

2. Click IPA Server.

   

3. On the IPA Server tab, click Configuration.

4. Set the required values in the Search Options area.

   Default values are:

   • Search size limit: 100 entries
   • Search time limit: 2 seconds

5. Click Save at the top of the page.

   

Procedure

1. Disable automatic cache tuning.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend config set --cache-autosize=0

2. Display the database suffixes and their corresponding back ends.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   cn=changelog (changelog)
   dc=example,dc=com (userroot)
   o=ipaca (ipaca)

   This command displays the name of the back end database next to each suffix. Use the suffix’s database name in the next step.

3. Set the entry cache size for the database. This example sets the entry cache for the userroot database to 2 gigabytes.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix set --cache-memsize=2147483648 userroot

4. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

5. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust cache-memsize to a different value, or re-enable cache auto-sizing.

Procedure

1. Disable automatic cache tuning, and set the database cache size. This example sets the database cache to 256 megabytes.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend config set --cache-autosize=0 --dbcachesize=268435456

2. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

3. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust dbcachesize to a different value, or re-enable cache auto-sizing.

Procedure

1. Stop the Directory Server.

   [root@server ~]# systemctl stop dirsrv.target

2. Backup the /etc/dirsrv/slapd-instance_name/dse.ldif file before making any further modifications.

   [root@server ~]# *cp /etc/dirsrv/slapd-instance_name/dse.ldif \
        /etc/dirsrv/slapd-instance_name/dse.ldif.bak.$(date "+%F_%H-%M-%S")

3. Edit the /etc/dirsrv/slapd-instance_name/dse.ldif file:

   1. Set the percentage of free system RAM to use for the database and entry caches back to the default of 10% of free RAM.

      nsslapd-cache-autosize: 10

   2. Set the percentage used from the free system RAM for the database cache to the default of 25%:

      nsslapd-cache-autosize-split: 25

4. Save your changes to the /etc/dirsrv/slapd-instance_name/dse.ldif file.

5. Start the Directory Server.

   [root@server ~]# systemctl start dirsrv.target

Procedure

1. Optional: Display the database suffixes and their corresponding database names.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   dc=example,dc=com (userroot)

   This command displays the name of the back end database next to each suffix. Use the suffix’s database name in the next step.

2. Set the DN cache size for the database. This example sets the DN cache to 20 megabytes.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix set --dncache-memsize=20971520 userroot

3. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust dncache-memsize to a different value, or back to the default of 10 MB.

Procedure

1. Ensure the NDN cache is enabled.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-ndn-cache-enabled
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-ndn-cache-enabled: on

   If the cache is off, enable it with the following command.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-ndn-cache-enabled=on
   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-ndn-cache-enabled"

2. Retrieve the current value of the nsslapd-ndn-cache-max-size parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-ndn-cache-max-size
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-ndn-cache-max-size: 20971520

3. Modify the value of the nsslapd-ndn-cache-max-size attribute. This example increases the value to 41943040 (40 MB).

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-ndn-cache-max-size=41943040

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-ndn-cache-max-size to a different value, or re-enable cache auto-sizing.

Procedure

1. Retrieve the current value of the nsslapd-maxbersize parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-maxbersize
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-maxbersize: 2097152

2. Modify the value of the nsslapd-maxbersize attribute. This example increases the value to 4194304, 4 MB.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-maxbersize=4194304

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-maxbersize"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-maxbersize to a different value, or back to the default of 2097152.

Procedure

1. Retrieve the current value of the nsslapd-maxdescriptors parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-maxdescriptors
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-maxdescriptors: 4096

2. Modify the value of the nsslapd-maxdescriptors attribute. This example increases the value to 8192.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-maxdescriptors=8192

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-maxdescriptors"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-maxdescriptors to a different value, or back to the default of 4096.

Procedure

1. Retrieve the current value of the nsslapd-listen-backlog-size parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-listen-backlog-size
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-listen-backlog-size: 128

2. Modify the value of the nsslapd-listen-backlog-size attribute. This example increases the value to 192.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-listen-backlog-size=192

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-listen-backlog-size"

Procedure

1. Retrieve the current value of the nsslapd-db-locks parameter and make a note of it before making any adjustments, in case it needs to be restored.

   [root@server ~]# ldapsearch -D "cn=directory manager" -w DirectoryManagerPassword -b "cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config" | grep nsslapd-db-locks
   nsslapd-db-locks: 50000

2. Modify the value of the locks attribute. This example doubles the value to 100000 locks.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend config set --locks=100000

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully updated database configuration

4. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

Procedure

1. Retrieve the current value of the nsslapd-ioblocktimeout parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-ioblocktimeout
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-ioblocktimeout: 10000

2. Modify the value of the nsslapd-ioblocktimeout attribute. This example lowers the value to 8000.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-ioblocktimeout=8000

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-ioblocktimeout"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-ioblocktimeout to a different value, or back to the default of 10000.

Procedure

1. Retrieve the current value of the nsslapd-idletimeout parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-idletimeout
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-idletimeout: 3600

2. Modify the value of the nsslapd-idletimeout attribute. This example lowers the value to 1800 (30 minutes).

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-idletimeout=1800

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-idletimeout"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-idletimeout to a different value, or back to the default of 3600.

Procedure

1. Display the database suffixes and their corresponding back ends.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   cn=changelog (changelog)
   dc=example,dc=com (userroot)
   o=ipaca (ipaca)

   This command displays the names of the back end databases next to their suffix. Use the suffix name in the next step.

2. Modify the value of the repl-release-timeout attribute for the main userroot database. This example increases the value to 90 seconds.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com replication set --suffix="dc=example,dc=com" --repl-release-timeout=90

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "repl-release-timeout"

4. Optional: If your IdM environment uses the IdM Certificate Authority (CA), you can modify the value of the repl-release-timeout attribute for the CA database. This example increases the value to 90 seconds.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com replication set --suffix="o=ipaca" --repl-release-timeout=90
   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "repl-release-timeout"

5. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

6. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust repl-release-timeout to a different value, or back to the default of 60 seconds.

Procedure

1. Create a text file in LDIF format with your custom database settings. Separate LDAP attribute modifications with a dash (-). This example sets non-default values for the idle timeout and maximum file descriptors.

   dn: cn=config
   changetype: modify
   replace: nsslapd-idletimeout
   nsslapd-idletimeout=1800
   -
   replace: nsslapd-maxdescriptors
   nsslapd-maxdescriptors=8192

2. Use the --dirsrv-config-file parameter to pass the LDIF file to the installation script.

   1. To install an IdM server:

      # ipa-server-install --dirsrv-config-file filename.ldif

   2. To install an IdM replica:

      # ipa-replica-install --dirsrv-config-file filename.ldif

Procedure

1. Open the /var/kerberos/krb5kdc/kdc.conf file in a text editor.

2. Set the TCP listen backlog to your desired value, such as 7.

   [kdcdefaults]
    ...
    kdc_tcp_listen_backlog = 7

3. Save and close the /var/kerberos/krb5kdc/kdc.conf file.
4. Restart the KDC to load the new settings.

Procedure

1. Open the /etc/krb5.conf file in a text editor.

2. Specify any options and their desired values within the [dbmodules] section, and in the respective Kerberos realm. In this example, you are setting the disable_last_success variable for the EXAMPLE.COM Kerberos realm.

   [dbmodules]
       EXAMPLE.COM = {
           disable_last_success = true
       }

3. Save and close the /etc/krb5.conf file.
4. Restart the KDC to load the new settings.

Procedure

1. Open the /etc/sysconfig/krb5kdc file in a text editor.

2. Specify the value of the KRB5KDC_ARGS parameter. In this example, you are setting the number of processes to 10:

   KRB5KDC_ARGS='-w 10'
   [...]

3. Save and close the /etc/sysconfig/krb5kdc file.

4. Reload the systemd configuration:

   # systemctl daemon-reload

5. Restart the krb5kdc service:

   # systemctl restart krb5kdc.service

Procedure

1. Open the /etc/sssd/sssd.conf configuration file in a text editor.

2. Add the following options to the [domain] section for your Identity Management (IdM) domain:

   [domain/idm.example.com]
   ignore_group_members = true
   subdomain_inherit = ignore_group_members
   ...

   Note

   Settings listed in the subdomain_inherit options apply to both the main (IdM) domain as well as the trusted AD domain(s).

3. Save and close the /etc/sssd/sssd.conf file on the server.

4. Restart the SSSD service to load the configuration changes.

   [root@client ~]# systemctl restart sssd

Procedure

1. Retrieve the total number of worker threads:

   # ldapsearch -xLLLD cn=directory\ manager -W -b cn=config -s base nsslapd-threadnumber
   Enter LDAP Password:
   dn: cn=config
   nsslapd-threadnumber: 16

   This means that the current value for ipaExtdomMaxInstances is 13.

2. Adjust the maximum number of instances. This example changes the value to 14:

   # ldapmodify -D "cn=directory manager" -W
   dn: cn=ipa_extdom_extop,cn=plugins,cn=config
   changetype: modify
   replace: ipaExtdomMaxInstances
   ipaExtdomMaxInstances: 14

3. Retrieve the current value of ipaExtdomMaxInstances:

   # ldapsearch -xLLLD "cn=directory manager" -W -b "cn=ipa_extdom_extop,cn=plugins,cn=config" |grep ipaextdommaxinstances
   
   Enter LDAP Password:
   
   ipaextdommaxinstances: 14

4. Monitor the IdM directory server’s performance and if it does not improve, repeat this procedure and adjust the value of the ipaExtdomMaxInstances variable.

Procedure

1. Determine the number of seconds a single un-cached login takes.

   1. Clear the SSSD cache on the IdM client client.example.com.

      [root@client ~]# sss_cache -E

   2. Measure how long it takes to log in as an AD user with the time command. In this example, from the IdM client client.example.com, log into the same host as the user ad-user from the ad.example.com AD domain.

      [root@client ~]# time ssh ad-user@ad.example.com@client.example.com

   3. Type in the password as soon as possible.

      Password:
      Last login: Sat Jan 23 06:29:54 2021 from 10.0.2.15
      [ad-user@ad.example.com@client ~]$

   4. Log out as soon as possible to display elapsed time. In this example, a single un-cached login takes about 9 seconds.

      [ad-user@ad.example.com@client /]$ exit
      logout
      Connection to client.example.com closed.
      
      real 0m8.755s
      user    0m0.017s
      sys     0m0.013s

2. Open the /etc/sssd/sssd.conf configuration file in a text editor.

3. Add the following options to the [domain] section for your Active Directory domain. Set the pam_id_timeout and krb5_auth_timeout options to the number of seconds an un-cached login takes. If you do not already have a domain section for your AD domain, create one.

   [domain/example.com/ad.example.com]
   krb5_auth_timeout = 9
   ldap_deref_threshold = 0
   ...

4. Add the following option to the [pam] section:

   [pam]
   pam_id_timeout = 9

5. Save and close the /etc/sssd/sssd.conf file on the server.

6. Restart the SSSD service to load the configuration changes.

   [root@client ~]# systemctl restart sssd

Procedure

1. Create a tmpfs temporary filesystem:

   1. On RHEL 8.6 and later, confirm that the SSSD user owns the config.ldb file:

      # ls -al /var/lib/sss/db/config.ldb
      -rw-------. 1 sssd sssd 1286144 Jun  8 16:41 /var/lib/sss/db/config.ldb

      Add the following entry to the /etc/fstab file as a single line:

      tmpfs /var/lib/sss/db/ tmpfs size=300M,mode=0700,uid=sssd,gid=sssd,rootcontext=system_u:object_r:sssd_var_lib_t:s0 0 0

   2. On RHEL 8 versions lower than 8.6, the config.ldb file is owned by the root user:

      # ls -al /var/lib/sss/db/config.ldb
      -rw-------. 1 root root 1286144 Jun  8 14:15 /var/lib/sss/db/config.ldb

      Add the following entry to the /etc/fstab file as a single line:

      tmpfs /var/lib/sss/db/ tmpfs size=300M,mode=0700,rootcontext=system_u:object_r:sssd_var_lib_t:s0 0 0

      This example creates a 300MB cache. Tune the size parameter according to your IdM and AD directory size, estimating 100 MBs per 10,000 LDAP entries.

2. Mount the new SSSD cache directory.

   [root@host ~]# mount /var/lib/sss/db/

3. Restart SSSD to reflect this configuration change.

   [root@host ~]# systemctl restart sssd