[SSSD-users] authentication against IPA with SSSD takes long (more than 5 seconds)

Lukas Slebodnik lslebodn at redhat.com
Wed Apr 15 18:08:02 UTC 2015


On (15/04/15 10:37), tmpchq wrote:
>It was my mistake, I missed [domain] section. Below is at log level 6:
>
>It spent time on checking for SELinux mapping, avahi and polkitd.
SELinux mapping should not be checked if you set "selinux_provider=none"
Some patches which improve speed caused by SELinux integration in ipa provider
were pushed to upstream.

You can test with snapshot of 1.12 branch
https://copr.fedoraproject.org/coprs/lslebodn/sssd-1-12-latest/

The initgroups was called for avahi and polkitd.
It cannot be filtered out with options filter_users, filter_groups
but it should not take a long time unless there is a problem with network.

It would be good to add add microseconds to the timestamp.
add "debug_microseconds = true" to domain section.

LS


More information about the sssd-users mailing list