On Wed, Nov 02, 2011 at 02:16:25PM +1000, GOLLSCHEWSKY, Tim wrote:
> Try setting ldap_group_nesting_level=1
Thanks for the tip. I tried it but it didn't make any difference.
I assume it's because we've "flattened" our groups already, so it's
probably has no effect.
> Frankly, I haven't noticed anything unusual in these logs. Perhaps someone else
will.
So I'm pretty much out of ideas now. I was hoping trac #1006 would fix my issue
(very slow login times:
https://fedorahosted.org/pipermail/sssd-devel/2011-September/007000.html) but it
hasn't made any difference.
Just a normal log in with my user id (which is a member of 149 groups) takes: 38.20s
It is an SSH login? If so, you might be interested in
https://fedorahosted.org/sssd/ticket/1063
If I move my /var/lib/sss into /dev/shm, it takes: 22.60s
Which is still pretty horrendous.
Are there any other options that I can try?
For login services other than SSH, raising the pam_id_timeout option
could help. I haven't been able to inspect the full logs, but it might
be possible that because one online initgroups() call takes so long,
a consequent step in the pam conversation does initgroups() online again
because we get past the timeout.
The default for pam_id_timeout is 5.