LDAP: Shortcut looking up for group members sooner

This patch is a performance enhancement. When looking for entries to
refresh, we always looked up all members in the cache, even if we ended
up dereferencing the whole group. If we are about to try dereference, it
makes sense to shortcut the lookups after the dereference threshold is
reached. In that case, the split_members function returns a special
error code and the caller just dereferences the whole group.

Only if dereference fails, we fall back to looking up all members so
that we can look them up one-by-one.

Also adds an integration test to make sure the dereference code works.

Reviewed-by: Sumit Bose <sbose@redhat.com>

2 files changed, 2 insertions, 0 deletions

diff --git a/src/util/util_errors.c b/src/util/util_errors.c
index 2d2bafb1e..3addcf1d3 100644
--- a/src/util/util_errors.c
+++ b/src/util/util_errors.c
@@ -93,6 +93,7 @@ struct err_string error_to_str[] = {
     { "Sysdb version is too new" },  /* ERR_SYSDB_VERSION_TOO_NEW */
     { "Domain has to timestamp cache" }, /* ERR_NO_TS */
     { "No timestamp cache record" }, /* ERR_TS_CACHE_MISS */
+    { "Dereference threshold reached" }, /* ERR_DEREF_THRESHOLD */
     { "ERR_LAST" } /* ERR_LAST */
 };
 
diff --git a/src/util/util_errors.h b/src/util/util_errors.h
index e8ea87765..fdf443c87 100644
--- a/src/util/util_errors.h
+++ b/src/util/util_errors.h
@@ -115,6 +115,7 @@ enum sssd_errors {
     ERR_SYSDB_VERSION_TOO_NEW,
     ERR_NO_TS,
     ERR_TS_CACHE_MISS,
+    ERR_DEREF_THRESHOLD,
     ERR_LAST            /* ALWAYS LAST */
 };