On (03/08/17 21:10), smfrench(a)gmail.com wrote:
In our of cases, we noticed RHEL7.3's "realm join"
taking more than 5 minutes (which timed out in our cli). As you can see from the verbose
output below the two longest stretches (greater than 2 minutes! each) were waiting between
launching "net ads join" and piping the password in (and similarly "net ads
keytab create" had a long delay between starting the command and giving it the
password). Looking at realmd service/realm-samba-enroll.c e.g. begin_net_process()
calling out to realm_command_runv_async it was not obvious why there should be any delay
between the launch of the net command the passing of the password (I did see one report of
"net ads keytab create" hanging if the keytab already existed but that is not
the same problem as this). Any idea how/why such long delays between launching net and
inputting the password in realmd async code? > 5 minutes is a long time to do
something that usually completes in 10 seconds
2017-08-01 19:54:09 realmd[14197]: * Performing LDAP DSE lookup on: ...
2017-08-01 19:54:09 realmd[14197]: * Successfully discovered ...
2017-08-01 19:54:10 realmd[14197]: * Required files: /usr/sbin/oddjobd,
/usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
2017-08-01 19:54:10 realmd[14197]: * Joining using a manual netbios name: ....
2017-08-01 19:54:10 realmd[14197]: * LANG=C LOGNAME=root /usr/bin/net -s
/var/cache/realmd/realmd-smb-conf.0DFU4Y -U <username> ads join <domain>
2017-08-01 19:56:42 realmd[14197]: Enter <username's> password:
2017-08-01 19:56:42 realmd[14197]: Using short domain name -- <short name>
2017-08-01 19:56:42 realmd[14197]: Joined ... to dns domain ...
2017-08-01 19:56:42 realmd[14197]: * LANG=C LOGNAME=root /usr/bin/net -s
/var/cache/realmd/realmd-smb-conf.0DFU4Y -U <username> ads keytab create
2017-08-01 19:59:33 realmd[14197]: Enter <username's> password:
I would recommend to move this discussion to sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
Unless you would like to provide a patch to sssd :-)
BTW It is possible that users on sssd-users might help with realmd question
but realmd has it separate mailing list
https://freedesktop.org/software/realmd/
http://lists.freedesktop.org/mailman/listinfo/authentication
LS