nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

iwreset, tons of users & groups, Solaris

pflory

Hi all,

I'm looking for feedback from anyone that's been in this boat:

- TeamSite 5/6 on Solaris (say vers 8)
- 400-500 users defined for TeamSite, say in /etc/passwd or LDAP
- 200-300 groups

When a soft iwreset (no flags) is executed, how long does it take?
Does TeamSite become unstable/unavailable during the reset, such that users have
problems performing regular operations?

Anyone?

Thanks,
Paul

Paul Flory

Find more posts tagged with

Comments

Migrateduser

Divide your user numbers by 2 and that's our setup.

A soft iwreset takes about 2 seconds for me.

Dave Smith
Sr. Software Engineer
Nike, Inc.
(503) 671-4238
DavidH.Smith@nike.com

pflory

Dave,

Thanks for the lightspeed reply!

I'm assuming you're using /etc/passwd & /etc/group rather than LDAP (?)

No known stability problems or impact during that iwreset? Like server crashes? ;-)

Regards,
Paul

Paul Flory

Migrateduser

Correct - we do not use LDAP. We never crash when we do a soft iwreset - it always comes back within a second or two. I'm not sure how the number of users and groups affects an iwreset, but we also have hundreds of branches and gigs of assets within those branches. The things that have bitten us are the Solaris limitation on number of groups per user and every once in a while a user will not be able to login and we'll have to do some magic and actually restart TeamSite to make that user work again. Other than that we run a smooth ship - no crashes in recent memory.

Dave Smith
Sr. Software Engineer
Nike, Inc.
(503) 671-4238
DavidH.Smith@nike.com

pflory

Here's why I've asked these questions:

We're looking to provide developers (say 10 users) a "self-service" CGI-style script to allow
them to update their group membership into groups, but no more than 10-16 groups at a time.

This is to avoid the very unsexy NFS 16-groups-per-user malady.

These developers need access to nearly *all* content. That content is going to be owned
by ~250 different groups, one for each branch.

If a developer self-updates her group membership, we need to perform an iwreset to re-read
the users/groups info into TeamSite. There are concerns that the TS server might suffer
a blow each time this happens. Mind you, these resets shouldn't be needed very often, but
nonetheless, there's a concern.

Let me know if this didn't make sense as it poured from a still-awakening mind.

-Paul

Paul Flory

Migrateduser

If your CGI is simply to allow current Solaris users to choose which Solaris groups they need to add themselves to, I don't think you need to perform an iwreset. I never do an iwreset after adding a user to a new group.

I don't understand how this will avoid the limitation on number of groups per user. If ultimately every developer is a member of all 250 groups, simply allowing them to only add themselves to 16 at a time doesn't change the fact that ultimately they will be members of all 250. Or am I reading your process wrong?

Dave Smith
Sr. Software Engineer
Nike, Inc.
(503) 671-4238
DavidH.Smith@nike.com

pflory

My writing skills are not completely booted yet --

At any one time a developer could belong to no more than, say, 10 or 15 groups (as we specify), *but* they
have the ability to *modify* this as needed during the course of their daily routines.

We could "lock down" which groups they have access to via the script, but they could at least do what
they need by updating their memberships.

Transient group membership. One day they belong to the Yacht club, the next day to the Imperfect Conception group, another day to the Lllama group. Drifters, in a sense, I suppose.

-Paul

Paul Flory

Migrateduser

Gotcha. That's certainly one way to do it. It would never fly with my users - they are severe Prima Donnas. That would be far too much work for them. I still don't think you need an iwreset after modifying the /etc/group file, though.

Dave Smith
Sr. Software Engineer
Nike, Inc.
(503) 671-4238
DavidH.Smith@nike.com

Drew_The_Goat

Hi,

I agree with Dave- when we update our /etc/group file we never need to issue an iwreset to have TeamSite know it- it just magically does know instantly after a change to the file.

Thanks,
Drew

pflory

Drew -

If you don't mind saying, how many groupss (roughly) do you have in /etc/group ?

How about # of users?

Curious about scalability issues with this approach.

Paul

Paul Flory

Drew_The_Goat

We have approx 50 groups and just over 100 users on the server- not all are TeamSite users, but that is the size of /etc/passwd/group. Some of our TeamSite users are already in over 16 groups (but still under 32), and everything still works fine.

Drew

Migrateduser

Currently I have 268 users and 181 groups.

Dave Smith
Sr. Software Engineer
Nike, Inc.
(503) 671-4238
DavidH.Smith@nike.com