-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/02/2014 07:51 AM, John Hodrien wrote:
On Mon, 2 Jun 2014, Stephen Gallagher wrote:
> This is the real problem. If SSSD can route to the IP address,
> then we have to proceed assuming that the LDAP server should be
> available (thereby attempting to connect to it and perform
> online authentication). There's really no way to determine ahead
> of time whether the service is "supposed" to be available.
>
> You may want to play with the option 'ldap_opt_timeout' (see
> sssd-ldap(5)). It controls how long the OpenLDAP client libraries
> will wait for a response (in your case, how long it will wait
> while the packets are dropped. It defaults to 6s).
This should be a one off hit though, right? If I discover the
LDAP server is offline, I should remember this, admittedly recheck
periodically, but never cause another delay waiting for it to
spring back into life. Given the way some of these laptops are
used, I'd even quite like to configure it to default to this
state.
When I last tried this (which was a while ago) these delays would
happen repeatedly, so the setup was unusable, and I had to ditch
sssd on the laptop.
Well, in most common cases, the LDAP server is unresolvable when not
on the VPN/inside the network, so SSSD immediately detects that it
can't get there and the delay is unnoticeable.
It's those cases where the server is addressable but unresponsive that
is much harder to handle.
Right now, we have a two-minute sleep between operations trying to go
online again. (I think I saw a patch go in for 1.12 that makes this
configurable). That's mostly so that we catch cases where you've
connected to the VPN but for one reason or another SSSD doesn't get
notified that the network state changed (there are lots of edge-cases
that cause this).
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
iEYEARECAAYFAlOMadkACgkQeiVVYja6o6MAcwCeNIGfCAQyhaKagU1vPt5hm1aj
RroAnjebqWadxdN01yL+Sdspms1jDFVh
=UAAQ
-----END PGP SIGNATURE-----