[SSSD-users] FreeIPA/SSSD LDAP cross-forest trust slow queries

Aviolat Romain Romain.Aviolat at nagra.com
Thu Feb 26 16:51:36 UTC 2015


We have setup FreeIPA (VERSION: 4.1.2, API_VERSION: 2.109) in our realm (IPA.DOMAIN1.COM), with trust to an AD forest (DOMAIN2.NET, which itself has trust to AD.DOMAIN2.NET, where the corporate users are). Everything works fine when using Kerberos, we can obtain tickets from AD.DOMAIN2.NET and authenticate to services in IPA.DOMAIN1.COM. We can also do "getent passwd user at ad.domain2.net" on a host enrolled in FreeIPA and quickly get a result.

But we have some legacy applications that perform authentication with simple LDAP binds, so we have the compat tree enabled, and while trying to authenticate users in the AD.DOMAIN2.NET realm this way eventually succeeds, it takes an awfully long time (30 seconds or so, sometimes more), with a lot going on between the AD and FreeIPA. We've attached the log file of SSSD (version 1.12.4, we've upgraded based on advice from IRC #sssd, but the problem didn't go away) from the FreeIPA server while running "ldapwhoami -D uid=user at ad.domain2.net,cn=users,cn=compat,dc=ipa,dc=domain1,dc=com -W" from a client machine. The debug level was set to 0x07f0.

On (rare) occasions, authentication is very fast while running the exact same command on the client machine. We've also attached the SSSD log file when that happens, for comparison. The log files have been sanitized and the slow log output was bit simplified, we removed 25 repeated  events where sssd was trying to resolve unknown SIDs, it would have taken too much time to sanitize so we left 5 caching events only (we made a remark on the log file where we removed those lines.)

Any advice is more than welcome.

Thanks for your help.


Romain Aviolat
Senior System Administrator - R&D and ops Infrastructure 
Kudelski Security - Kudelski Group 
rte de Genève 22-24, 1033 Cheseaux, SWITZERLAND
+41 21 732 03 79

-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd_slow_query.zip
Type: application/x-zip-compressed
Size: 6873 bytes
Desc: sssd_slow_query.zip
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150226/ec0cca13/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd_fast_query.zip
Type: application/x-zip-compressed
Size: 1366 bytes
Desc: sssd_fast_query.zip
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150226/ec0cca13/attachment-0001.bin>

More information about the sssd-users mailing list