[SSSD-users] authentication against IPA with SSSD takes long (more than 5 seconds)

Dmitri Pal dpal at redhat.com
Mon Apr 13 21:41:43 UTC 2015


On 04/13/2015 05:29 PM, Qing Chang wrote:
> Thanks Lucas for the information.
>
> I tried the selinux line, it did not seem to make a difference.
>
> As I said in my original email, login to the IPA server itself does 
> not exhibit the same behavior, although
> every system has the same SSSD configuration and SElinux enabled. I 
> actually tried "setenforce 0"
> on a client without any effect either.
>
> I checked all the reference you provided, my feelings is that the 
> events add up still would not account for 5 seconds delay:-(
>
> If anybody would like to have debug information, please let me know 
> (the procedure to produce). Please also let me know if I should file a 
> bug.

Please see SSSD troubleshooting page. [1]
Rise debug_level, inspect the logs and see what operation is really 
taking the time.

I suspect this there some DNS release timeout that you are hitting but 
without logs it is not possible to say.

[1] https://fedorahosted.org/sssd/wiki/Troubleshooting

>
> Many thanks,
> Qing
>
> On Mon, Apr 13, 2015 at 4:22 PM, Lukas Slebodnik <lslebodn at redhat.com 
> <mailto:lslebodn at redhat.com>> wrote:
>
>     On (13/04/15 15:28), Qing Chang wrote:
>     >OS: CentoOS 7.1
>     >IPA: 4.1.0-18
>     >SSSD: 1.12.2-58
>     >
>     >With IPA any clients running CentOS7.1 authentication for ssh and
>     sudo
>     >takes more than 5 seconds _after_ putting in password. If ssh to
>     the IPA
>     >server itself, it authenticates instantly.
>     >
>     >Google did not provide much relevant information. Note that this
>     is not a
>     >slow ssh session to get to authentication prompt, it always gets
>     to the
>     >prompt without delay.
>     >
>     >Also it is not related to NFS performance, it is equally slow if
>     I login to
>     >a NFS server (IPA client) locally or login to a server (also a
>     IPA client)
>     >that has autofs home.
>     >
>     >IPA server is a fresh installation with just a couple of users. I
>     had an
>     >installation previously that has more than a thousand user
>     accounts on
>     >CentOS 6. Users did not have the slowness problem as with this new
>     >installation.
>     >
>     >Hope this list can provide some pointers.
>     >
>     You might hit bug[1].
>
>     If you do not use SELinux ser mapping[2] you can try to disable
>     this feature.
>
>     put "selinux_provider = none" into domain section of sssd.conf
>
>     If it doesn't help you can tahe a look on sssd<->systemd
>     conversation in mail
>     thread[3]
>
>     LS
>
>     [1] https://fedorahosted.org/sssd/ticket/2624
>     [2] https://www.freeipa.org/page/SELinux_user_mapping
>     [3]
>     http://lists.freedesktop.org/archives/systemd-devel/2015-April/030496.html
>     _______________________________________________
>     sssd-users mailing list
>     sssd-users at lists.fedorahosted.org
>     <mailto:sssd-users at lists.fedorahosted.org>
>     https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>
>
>
>
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150413/b871da3a/attachment-0001.html>


More information about the sssd-users mailing list