<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 04/13/2015 05:29 PM, Qing Chang
      wrote:<br>
    </div>
    <blockquote
cite="mid:CAD+c6m=cT2a6hgrYcqo_vwDVVedJaFWTWKUvUV3FuAKie0nHdA@mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div>
          <div>
            <div>
              <div>Thanks Lucas for the information.<br>
                <br>
              </div>
              I tried the selinux line, it did not seem to make a
              difference. <br>
              <br>
            </div>
            As I said in my original email, login to the IPA server
            itself does not exhibit the same behavior, although <br>
            every system has the same SSSD configuration and SElinux
            enabled. I actually tried "setenforce 0"<br>
          </div>
          on a client without any effect either.<br>
          <br>
        </div>
        <div>I checked all the reference you provided, my feelings is
          that the events add up still would not account for 5 seconds
          delay:-( <br>
          <br>
        </div>
        <div>If anybody would like to have debug information, please let
          me know (the procedure to produce). Please also let me know if
          I should file a bug.<br>
        </div>
      </div>
    </blockquote>
    <br>
    Please see SSSD troubleshooting page. [1]<br>
    Rise debug_level, inspect the logs and see what operation is really
    taking the time.<br>
    <br>
    I suspect this there some DNS release timeout that you are hitting
    but without logs it is not possible to say.<br>
    <br>
    [1] <a class="moz-txt-link-freetext" href="https://fedorahosted.org/sssd/wiki/Troubleshooting">https://fedorahosted.org/sssd/wiki/Troubleshooting</a><br>
    <br>
    <blockquote
cite="mid:CAD+c6m=cT2a6hgrYcqo_vwDVVedJaFWTWKUvUV3FuAKie0nHdA@mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div><br>
        </div>
        <div>Many thanks,<br>
        </div>
        <div>Qing<br>
        </div>
      </div>
      <div class="gmail_extra"><br>
        <div class="gmail_quote">On Mon, Apr 13, 2015 at 4:22 PM, Lukas
          Slebodnik <span dir="ltr">&lt;<a moz-do-not-send="true"
              href="mailto:lslebodn@redhat.com" target="_blank">lslebodn@redhat.com</a>&gt;</span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div class="HOEnZb">
              <div class="h5">On (13/04/15 15:28), Qing Chang wrote:<br>
                &gt;OS: CentoOS 7.1<br>
                &gt;IPA: 4.1.0-18<br>
                &gt;SSSD: 1.12.2-58<br>
                &gt;<br>
                &gt;With IPA any clients running CentOS7.1
                authentication for ssh and sudo<br>
                &gt;takes more than 5 seconds _after_ putting in
                password. If ssh to the IPA<br>
                &gt;server itself, it authenticates instantly.<br>
                &gt;<br>
                &gt;Google did not provide much relevant information.
                Note that this is not a<br>
                &gt;slow ssh session to get to authentication prompt, it
                always gets to the<br>
                &gt;prompt without delay.<br>
                &gt;<br>
                &gt;Also it is not related to NFS performance, it is
                equally slow if I login to<br>
                &gt;a NFS server (IPA client) locally or login to a
                server (also a IPA client)<br>
                &gt;that has autofs home.<br>
                &gt;<br>
                &gt;IPA server is a fresh installation with just a
                couple of users. I had an<br>
                &gt;installation previously that has more than a
                thousand user accounts on<br>
                &gt;CentOS 6. Users did not have the slowness problem as
                with this new<br>
                &gt;installation.<br>
                &gt;<br>
                &gt;Hope this list can provide some pointers.<br>
                &gt;<br>
              </div>
            </div>
            You might hit bug[1].<br>
            <br>
            If you do not use SELinux ser mapping[2] you can try to
            disable<br>
            this feature.<br>
            <br>
            put "selinux_provider = none" into domain section of
            sssd.conf<br>
            <br>
            If it doesn't help you can tahe a look on
            sssd&lt;-&gt;systemd conversation in mail<br>
            thread[3]<br>
            <br>
            LS<br>
            <br>
            [1] <a moz-do-not-send="true"
              href="https://fedorahosted.org/sssd/ticket/2624"
              target="_blank">https://fedorahosted.org/sssd/ticket/2624</a><br>
            [2] <a moz-do-not-send="true"
              href="https://www.freeipa.org/page/SELinux_user_mapping"
              target="_blank">https://www.freeipa.org/page/SELinux_user_mapping</a><br>
            [3] <a moz-do-not-send="true"
href="http://lists.freedesktop.org/archives/systemd-devel/2015-April/030496.html"
              target="_blank">http://lists.freedesktop.org/archives/systemd-devel/2015-April/030496.html</a><br>
            <div class="HOEnZb">
              <div class="h5">_______________________________________________<br>
                sssd-users mailing list<br>
                <a moz-do-not-send="true"
                  href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a><br>
                <a moz-do-not-send="true"
                  href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users"
                  target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
              </div>
            </div>
          </blockquote>
        </div>
        <br>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
sssd-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a>
</pre>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
  </body>
</html>