On 07.12.21 19:45, John Desantis via FreeIPA-users wrote:
Georg,
> In order to analyze our setup, we pinned one random IPA client onto one IPA Server in
sssd.conf and started with debug_level=6 in all config sections.
When we were investigating performance issues, we actually changed the
debug_level to 9 on both the IPA server and client for the duration of
testing.
> After deleting the cache on both machines and restarting the sssd service, the login
with our AD-User on the IPA server works right away. Whereas, the client takes up to ~10
minutes before the login with our AD Account works at all.
What I'd recommend as a start is:
1.) Stop the client.
2.) Remove the cache (/var/lib/sss/db/).
3.) Remove all SSSD logs.
4.) Set the debug_level to 9 in the [domain], [sssd], [nss], and
[pam] sections. It may be superfluous, but at least you'll know
you're capturing all of the logs.
5.) Start the client.
6.) Attempt a login to the client and continue until you've noticed a
significant delay.
You can then search for the user(s) in question within the SSSD logs.
Look for any obvious errors and timeouts, then search for all lookups
from the client to the server (user, groups, HBAC, etc.).
I'd also run a time `getent passwd ADUSER` against a _fresh_ cache
(step #2 above) to see how quickly a result is returned, if at all.
Depending on how the client is configured, perhaps the delay is due to
multiple, initial lookup failures.
HTH,
John DeSantis
What is your experience regarding SSH logins or lookups (getent)? How
long do they take in your setup? Uncached SSH logins with AD users do
take up to 30 seconds or more at our site.
Cheers,
Ronald