[SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down.

Mark London mrl at psfc.mit.edu
Mon Aug 13 20:16:06 UTC 2012


Hi - When our primary DNS is unreachable, SSSD with LDAP breaks, or is 
incredibly slow.  I've traced it to the fact that several of the LDAP 
timeout values are 6 seconds.  This is not long enough, because the 
default DNS timeout failover is 5 seconds.  Incoming SSH connections are 
impossible with increasing the LDAP timeout value.  I'm not sure yet 
which is the critical setting, but I've increased the following from 6 
seconds to 30:

 ldap_network_timeout = 30
 ldap_opt_timeout = 30
 ldap_search_timeout = 30

What I don't understand is, even with this increase, while it allows SSH 
logins to work, it still takes about 1 1/2 minutes to login to the 
computer.  The logs show that every LDAP connection takes about 5 
seconds to complete.  That seems to imply to me that the code doing an 
DNS Lookup to the primary DNS server, rather than using the local DNS 
cache.  See below.  I've not traced the code, to see if in fact this is 
the case.  But whatever the reason, LDAP connections are taking a long 
time, with the primary DNS server being down:

(Mon Aug 13 15:43:46 2012) [sssd[be[PSFC]]] 
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to 
[ldaps://ForestDnsZones.psfc.mit.edu/DC=ForestDnsZones,DC=psfc,DC=mit,DC=edu] 
with fd [32].
(Mon Aug 13 15:43:51 2012) [sssd[be[PSFC]]] 
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to 
[ldaps://DomainDnsZones.psfc.mit.edu/DC=DomainDnsZones,DC=psfc,DC=mit,DC=edu] 
with fd [33].
(Mon Aug 13 15:43:56 2012) [sssd[be[PSFC]]] 
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to 
[ldaps://psfc.mit.edu/CN=Configuration,DC=psfc,DC=mit,DC=edu] with fd [34].
(Mon Aug 13 15:43:56 2012) [sssd[be[PSFC]]] [sdap_rebind_proc] (0x1000): 
Successfully bind to 
[ldaps://DomainDnsZones.psfc.mit.edu/DC=DomainDnsZones,DC=psfc,DC=mit,DC=edu].
(Mon Aug 13 15:43:56 2012) [sssd[be[PSFC]]] [sdap_rebind_proc] (0x1000): 
Successfully bind to 
[ldaps://ForestDnsZones.psfc.mit.edu/DC=ForestDnsZones,DC=psfc,DC=mit,DC=edu].

This is true, even though I have enumeration turned on, with long cached 
timeouts:

 enum_cache_timeout = 86400
 ldap_purge_cache_timeout = 0
 ldap_enumeration_refresh_timeout = 300

I was under the impression that enumeration prevented blocking, and used 
cache values, rather than waiting for LDAP requests to finish. 

Any comments, or opinions on how to fix this problem?  Thanks.

- Mark





More information about the sssd-devel mailing list