sambaXP 2024: What does the KCC do?
Talk by Douglas Bagnall (Catalyst IT / Samba Team)
Abstract:
In Active Directory, KCC stands for „Knowledge Consistency Checker“, which is an outstandingly non-descriptive term even by the standards of the field. It is periodically run on all DCs to calculate a replication graph for the domain, so that changes on each DC are replicated to the others via an efficient route.
The KCC runs independently on each DC, using the network description in the database, and it needs to come up with the same answer on all DCs. For the perhaps obsolete reason of economizing on inter-site traffic, it creates a sparse tree between sites but well connected graphs within sites.
The algorithm needs to be robust at all networks scales, and cope with changes over time and with mixed networks of different versions of Windows and Samba.
Samba's KCC implementation was written in Python, largely by people who didn't really know what they were doing. It has some terrible workarounds for the Python binding bugs we had at the time.
The combination of inherently complex algorithm and some awful Python is enhanced by a tersely written specification. This makes it hard for anyone to work out what the KCC is actually doing, and whether what it is doing is what it means. I will try to explain what is going on, and maybe add some words about what we could do differently.
Slides: https://sambaxp.org/fileadmin/user_up...
Visit the conference website at: https://sambaxp.org