Issue

sudorule-mod performance degraded with freeipa-4.9.3* build in fedora-34 as compared to freeipa-4.9.3 build in fedora-33

Mod operation done on 100 sudorules on fedora-33 vs fedora-34 with freeipa-4.9.3 build available there.

Avg time taken on fedora33 with build freeipa-server-4.9.3-1.fc33.x86_64 = 1m13.808s
Avg time taken on fedora34 with build freeipa-server-4.9.3-2.fc34.x86_64 = 2m43.646s

Time taken more on fedora34 with build freeipa-server-4.9.3-2.fc34.x86_64 = 1m29.838s

Steps to Reproduce

1. Install IPA
2. Use following script to perform n number of sudorule-mod operation on n number of sudorules..

Test script used:

[root@ ~]# cat test.sh 
#!/bin/sh
#Adding sudorule without sudoorder attribute
echo xxxxxx|kinit admin
for i in `seq 1 $1`;
do
  ipa sudorule-add sudorule$i
done
# Modifying sudorule with sudoorder attribute change
time for i in `seq 1 $1`;
do
  ipa sudorule-mod sudorule$i --order=$i
done
#Delete the sudorules
for i in `seq 1 $1`;
do
  ipa sudorule-del sudorule$i
done
[root@ ~]# 

1. for i in {1..5}; do time=$(sh test.sh 100 2>&1 > /dev/null);echo $time|cut -d " " -f2; done

Actual behavior

[root@ ~]# for i in {1..5}; do time=$(sh test.sh 100 2>&1 > /dev/null);echo $time|cut -d " " -f2; done
2m43.993s
2m45.784s
2m43.477s
2m43.779s
2m41.200s
[root@ ~]# rpm -q freeipa-server
freeipa-server-4.9.3-2.fc34.x86_64
[root@qe-blade-03 ~]#

Avg time for 100 sudorules mod operation: 2m43.646s

Same operation took 1m13.808s on fedora-33 with build freeipa-server-4.9.3-1.fc33.x86_64

[root@ ~]# for i in {1..5}; do time=$(sh test.sh 100 2>&1 > /dev/null);echo $time|cut -d " " -f2; done
1m12.372s
1m19.553s
1m12.616s
1m17.871s
1m6.631s
[root@ ~]# rpm -q freeipa-server
freeipa-server-4.9.3-1.fc33.x86_64
[root@ ~]#

Avg time for 100 sudorules mod operation: 1m13.808s

Expected behavior

Expected same time for this sudorule-mod operation as seen on fedora33 with build freeipa-server-4.9.3-1.fc33.x86_64