[SSSD-users] timeout and offline mode behaviour

Stephen Gallagher sgallagh at redhat.com
Mon Jun 2 11:49:09 UTC 2014

Hash: SHA1

On 06/02/2014 04:34 AM, Joschi Brauchle wrote:
> Hello everone,
> we have an issue/problem that seems highly related to the current 
> "timeout and offline mode behaviour".
> We have several SSSD 1.9.5 systems with "cache_credentials =
> true", which experience periodic blocking/pausing of the complete X
> session for several seconds (~5-10) when these machines are not
> connected to their home network. The user is not able to use the
> machine at all during these lockups, which is very annoying...
> These are some of the details: 1) The LDAP server has a local
> 192.168.x.x IP, which is resolvable globally. 2) The LDAP server is
> behind a firewall, dropping packets from outside networks.

This is the real problem. If SSSD can route to the IP address, then we
have to proceed assuming that the LDAP server should be available
(thereby attempting to connect to it and perform online
authentication). There's really no way to determine ahead of time
whether the service is "supposed" to be available.

You may want to play with the option 'ldap_opt_timeout' (see
sssd-ldap(5)). It controls how long the OpenLDAP client libraries will
wait for a response (in your case, how long it will wait while the
packets are dropped. It defaults to 6s).

> 3) The lockups seem to occur if the clients are not connected to
> this "home" network but to a different network with similar
> configuration (192.168.x.x, which is pretty common).
> I am still trying to track down the issue with "debug_level = 9"
> and get the logs of such a lockup.
> @Jakub: Could you let me know which openLDAP version you are using
> and suspecting to be the problem? Could you let me know how to
> trigger/test the issue reliably (the DNS setup you are using to
> trigger it)?
> I would like to confirm that we are having the same or possibly 
> different problem...
> Best regards, Joschi Brauchle
> _______________________________________________ sssd-users mailing
> list sssd-users at lists.fedorahosted.org 
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users

Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/


More information about the sssd-users mailing list