[23230] in Kerberos
Re: Kerberos Database Size
daemon@ATHENA.MIT.EDU (Ken Raeburn)
Thu Jan 20 15:31:20 2005
In-Reply-To: <40A0F504-6B12-11D9-B139-000D9340E016@cornell.edu>
Mime-Version: 1.0 (Apple Message framework v619)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <1BAC1DB6-6B22-11D9-A5E2-000A95909EE2@mit.edu>
Content-Transfer-Encoding: 7bit
From: Ken Raeburn <raeburn@mit.edu>
Date: Thu, 20 Jan 2005 15:30:22 -0500
To: Steve Edgar <se10@cornell.edu>
cc: "'kerberos@mit.edu'" <kerberos@mit.edu>
Errors-To: kerberos-bounces@mit.edu
On Jan 20, 2005, at 13:36, Steve Edgar wrote:
> Does anyone know how large a Kerberos database on a single KDC can get
> before performance becomes an issue? For example, would a Kerberos
> database be able to handle 750,000 principals? 1,000,000 principals?
> Hardware is a major factor, but assuming the KDC is on a "relatively
> fast" hardware configuration, are there any other limiting factors?
I would think in most cases the the transaction rate would be a lot
more interesting than the database size. Two
extreme-to-the-point-of-absurdity cases: A database with 10**6
principals should be just fine if you have less than one request per
second, but a KDC may not be able to handle 10**6 transactions per
second no matter how small the database is. Of course, for transaction
rates in between, the database size *and structure* will affect the
cost of looking up any one given database entry. If that gets to be a
problem, one could tweak the software a bit (in the open source
implementations) to gain some speedups, like caching the data for the
TGT and a few popular services, and maybe the last N client principals;
cache key schedules for certain keys; stuff like that.
All that hand-waving aside, I'd be curious to see numbers (db size and
transaction rates) for various sites, especially any sites that have
found KDC performance to be a problem. (And especially if it's with
the MIT KDC code.)
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
