[SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down. (Mark London)

Jakub Hrozek jhrozek at redhat.com
Tue Aug 14 14:52:21 UTC 2012


On Tue, Aug 14, 2012 at 10:35:56AM -0400, Mark London wrote:
> 
> Jakub Hrozek <jhrozek at redhat.com> wrote
> >On Mon, Aug 13, 2012 at 10:16:49PM -0400, Mark London wrote:
> >>Mark London wrote:
> >>>Hi - When our primary DNS is unreachable, SSSD with LDAP breaks,
> >>>or is incredibly slow.  I've traced it to the fact that several of
> >>>the LDAP timeout values are 6 seconds.  This is not long enough,
> >>>because the default DNS timeout failover is 5 seconds.  Incoming
> >>>SSH connections are impossible without increasing the LDAP timeout
> >>>value.  I'm not sure yet which is the critical setting, but I've
> >>>increased the following from 6 seconds to 30:
> >>I found the dns_resolver_timeout variable and changed it from 5 seconds 1
> >>second, but that didn't help.  I still see 5 second delays when
> >>sdap_ldap_connect_callback_add is called.   It would be nice if  the
> >>internal resolver had a cache!  Any other suggestions?  I'll be
> >>happy to hack the code, if someone could give me any idea of what
> >>needs to be fixed.  This situation has occurred several times over
> >>the past few months, causing major problems.  Thanks.
> >
> >I would recommend turning off the referral support:
> >    ldap_referrals = false
> >
> >That should get rid of many reconnection attempts. We don't control name
> >resolution for referred servers and I suspect the resolution is done
> >internally in libldap.
> >
> 
> Thanks for the info!  That reduces the time to login to 50 seconds.
> Much better!  Perhaps the default for that setting should be false?
> 

For the upcoming AD provider, the setting defaults to false.

The AD provider is a new feature of SSSD 1.9, if your setup includes an
AD client, maybe you would be interested in testing it out?

We are tracking some performance issues upstream
(https://fedorahosted.org/sssd/ticket/1355) but the functionality should
be there.



More information about the sssd-devel mailing list