It appears that the IPA command uses a host hardwired in /etc/ipa/default.conf.
If that fails, it then gets a list from DNS. This works fine if there’s a connection
refused, but if there is no response, it takes so long to time out that most users will
give up.
Is there a way to change the timeout?