<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 04/13/2015 05:29 PM, Qing Chang
wrote:<br>
</div>
<blockquote
cite="mid:CAD+c6m=cT2a6hgrYcqo_vwDVVedJaFWTWKUvUV3FuAKie0nHdA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>Thanks Lucas for the information.<br>
<br>
</div>
I tried the selinux line, it did not seem to make a
difference. <br>
<br>
</div>
As I said in my original email, login to the IPA server
itself does not exhibit the same behavior, although <br>
every system has the same SSSD configuration and SElinux
enabled. I actually tried "setenforce 0"<br>
</div>
on a client without any effect either.<br>
<br>
</div>
<div>I checked all the reference you provided, my feelings is
that the events add up still would not account for 5 seconds
delay:-( <br>
<br>
</div>
<div>If anybody would like to have debug information, please let
me know (the procedure to produce). Please also let me know if
I should file a bug.<br>
</div>
</div>
</blockquote>
<br>
Please see SSSD troubleshooting page. [1]<br>
Rise debug_level, inspect the logs and see what operation is really
taking the time.<br>
<br>
I suspect this there some DNS release timeout that you are hitting
but without logs it is not possible to say.<br>
<br>
[1] <a class="moz-txt-link-freetext" href="https://fedorahosted.org/sssd/wiki/Troubleshooting">https://fedorahosted.org/sssd/wiki/Troubleshooting</a><br>
<br>
<blockquote
cite="mid:CAD+c6m=cT2a6hgrYcqo_vwDVVedJaFWTWKUvUV3FuAKie0nHdA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br>
</div>
<div>Many thanks,<br>
</div>
<div>Qing<br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Apr 13, 2015 at 4:22 PM, Lukas
Slebodnik <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:lslebodn@redhat.com" target="_blank">lslebodn@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb">
<div class="h5">On (13/04/15 15:28), Qing Chang wrote:<br>
>OS: CentoOS 7.1<br>
>IPA: 4.1.0-18<br>
>SSSD: 1.12.2-58<br>
><br>
>With IPA any clients running CentOS7.1
authentication for ssh and sudo<br>
>takes more than 5 seconds _after_ putting in
password. If ssh to the IPA<br>
>server itself, it authenticates instantly.<br>
><br>
>Google did not provide much relevant information.
Note that this is not a<br>
>slow ssh session to get to authentication prompt, it
always gets to the<br>
>prompt without delay.<br>
><br>
>Also it is not related to NFS performance, it is
equally slow if I login to<br>
>a NFS server (IPA client) locally or login to a
server (also a IPA client)<br>
>that has autofs home.<br>
><br>
>IPA server is a fresh installation with just a
couple of users. I had an<br>
>installation previously that has more than a
thousand user accounts on<br>
>CentOS 6. Users did not have the slowness problem as
with this new<br>
>installation.<br>
><br>
>Hope this list can provide some pointers.<br>
><br>
</div>
</div>
You might hit bug[1].<br>
<br>
If you do not use SELinux ser mapping[2] you can try to
disable<br>
this feature.<br>
<br>
put "selinux_provider = none" into domain section of
sssd.conf<br>
<br>
If it doesn't help you can tahe a look on
sssd<->systemd conversation in mail<br>
thread[3]<br>
<br>
LS<br>
<br>
[1] <a moz-do-not-send="true"
href="https://fedorahosted.org/sssd/ticket/2624"
target="_blank">https://fedorahosted.org/sssd/ticket/2624</a><br>
[2] <a moz-do-not-send="true"
href="https://www.freeipa.org/page/SELinux_user_mapping"
target="_blank">https://www.freeipa.org/page/SELinux_user_mapping</a><br>
[3] <a moz-do-not-send="true"
href="http://lists.freedesktop.org/archives/systemd-devel/2015-April/030496.html"
target="_blank">http://lists.freedesktop.org/archives/systemd-devel/2015-April/030496.html</a><br>
<div class="HOEnZb">
<div class="h5">_______________________________________________<br>
sssd-users mailing list<br>
<a moz-do-not-send="true"
href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a><br>
<a moz-do-not-send="true"
href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users"
target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
sssd-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>