[SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down. (Mark London)
Jakub Hrozek
jhrozek at redhat.com
Tue Aug 14 14:52:21 UTC 2012
On Tue, Aug 14, 2012 at 10:35:56AM -0400, Mark London wrote:
>
> Jakub Hrozek <jhrozek at redhat.com> wrote
> >On Mon, Aug 13, 2012 at 10:16:49PM -0400, Mark London wrote:
> >>Mark London wrote:
> >>>Hi - When our primary DNS is unreachable, SSSD with LDAP breaks,
> >>>or is incredibly slow. I've traced it to the fact that several of
> >>>the LDAP timeout values are 6 seconds. This is not long enough,
> >>>because the default DNS timeout failover is 5 seconds. Incoming
> >>>SSH connections are impossible without increasing the LDAP timeout
> >>>value. I'm not sure yet which is the critical setting, but I've
> >>>increased the following from 6 seconds to 30:
> >>I found the dns_resolver_timeout variable and changed it from 5 seconds 1
> >>second, but that didn't help. I still see 5 second delays when
> >>sdap_ldap_connect_callback_add is called. It would be nice if the
> >>internal resolver had a cache! Any other suggestions? I'll be
> >>happy to hack the code, if someone could give me any idea of what
> >>needs to be fixed. This situation has occurred several times over
> >>the past few months, causing major problems. Thanks.
> >
> >I would recommend turning off the referral support:
> > ldap_referrals = false
> >
> >That should get rid of many reconnection attempts. We don't control name
> >resolution for referred servers and I suspect the resolution is done
> >internally in libldap.
> >
>
> Thanks for the info! That reduces the time to login to 50 seconds.
> Much better! Perhaps the default for that setting should be false?
>
For the upcoming AD provider, the setting defaults to false.
The AD provider is a new feature of SSSD 1.9, if your setup includes an
AD client, maybe you would be interested in testing it out?
We are tracking some performance issues upstream
(https://fedorahosted.org/sssd/ticket/1355) but the functionality should
be there.
More information about the sssd-devel
mailing list