nis server: limit group.byname and group.bygid maps to POSIX groups

[abbra]

For NIS maps only POSIX groups make sense. Limit searches to those. This should avoid pulling groups like 'ipausers' into NIS maps. It also will help with large non-POSIX groups being rebuilt when a new member is added because then NIS maps wouldn't need to be rebuilt.

In a real life scenario this reduced time spent on adding a user from 45 seconds to 15 seconds: 'ipausers' group membership change does not trigger a rebuild of NIS maps anymore.

Fixes: https://pagure.io/freeipa/issue/9388

[rcritten]

Is there a way to tell in the logs that a NIS rebuild is triggered? Or can this be observed only by the reduced time to add a new user? How many users did you test with?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[abbra]

Rebased and removed the temporary commit which used 389-ds nightly COPR.

[flo-renaud]

New installation and upgrade work well (tested both with the plugin enabled or disabled).
Same question as @rcritten , is there an easy way to check the performance difference?

[abbra]

According to the reporter (in bugzilla), they have had ~2100 users in ipausers group. Adding a new user causes NIS to trigger dereference requests in NIS plugin (and in compat tree, I guess) which slow down ipa user-add for them substantially. Doing this change made them to observe 45 to 15 seconds speed up for each new user added. ipausers group is non-POSIX one and should not be seen by both NIS and Compat tree plugins.

Thus a test would be to create new users continuously. I believe freeipa-perftest would show the difference in groupsize test?

[rcritten]

I tested with NIS enabled with and without the patch applied using a different methodology.

I did the time to add 2100 users sequentially. There is no apparently difference in the times with and without the patch. In total it takes ~230 minutes. Without NIS enabled it takes 30m.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.