Hi,
We have setup FreeIPA (VERSION: 4.1.2, API_VERSION: 2.109) in our realm (
IPA.DOMAIN1.COM),
with trust to an AD forest (
DOMAIN2.NET, which itself has trust to
AD.DOMAIN2.NET, where
the corporate users are). Everything works fine when using Kerberos, we can obtain tickets
from
AD.DOMAIN2.NET and authenticate to services in
IPA.DOMAIN1.COM. We can also do
"getent passwd user(a)ad.domain2.net" on a host enrolled in FreeIPA and quickly
get a result.
But we have some legacy applications that perform authentication with simple LDAP binds,
so we have the compat tree enabled, and while trying to authenticate users in the
AD.DOMAIN2.NET realm this way eventually succeeds, it takes an awfully long time (30
seconds or so, sometimes more), with a lot going on between the AD and FreeIPA. We've
attached the log file of SSSD (version 1.12.4, we've upgraded based on advice from IRC
#sssd, but the problem didn't go away) from the FreeIPA server while running
"ldapwhoami -D uid=user(a)ad.domain2.net,cn=users,cn=compat,dc=ipa,dc=domain1,dc=com
-W" from a client machine. The debug level was set to 0x07f0.
On (rare) occasions, authentication is very fast while running the exact same command on
the client machine. We've also attached the SSSD log file when that happens, for
comparison. The log files have been sanitized and the slow log output was bit simplified,
we removed 25 repeated events where sssd was trying to resolve unknown SIDs, it would
have taken too much time to sanitize so we left 5 caching events only (we made a remark on
the log file where we removed those lines.)
Any advice is more than welcome.
Thanks for your help.
Cheers,
Romain Aviolat
Senior System Administrator - R&D and ops Infrastructure
Kudelski Security - Kudelski Group
rte de Genève 22-24, 1033 Cheseaux, SWITZERLAND
+41 21 732 03 79