We do have several hundred IPA clients at the moment. People are advised
to use their AD users when connecting to an IPA client via SSH.
Colleagues are reporting constantly that uncached logins are taking way
to long. I did even see colleagues returning to creating local user
accounts...
I am aware of the tuning guide
https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-larg...
. We have implemented all tunables described there on the server side.
We have tens of thousands of users in our AD. Maybe the whole AD<->IPA
setup should be implemented in a completely different way?
Please help me to further analyze and tune our IPA installation in order
to minimize SSH login times.
Cheers,
Ronald