<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi,<div class="">how could I possibly trace why there is a noticeable delay when logging into sssd enabled server?</div><div class="">With ssh there is a 2-3 second delay before users logs in. But most users notice this with webmail, which uses dovecot->pam->sssd as authentication backend.</div><div class="">Environment is Centos 7.1 and FreeIPA 4.1.0 servers, two redundant.</div><div class="">Client also running Centos 7.1 with sssd.</div><div class="">Installation as per IPA handbook. DNS is proper (or so I think :) ).</div><div class="">Nothing special in logs that I could attribute to this problem except maybe that for each successful login there is a pam_unix failure entry in /var/log/secure log like:</div><div class="">Jun 1 17:38:36 mail auth: <b class="">pam_unix</b>(dovecot:auth): <b class="">authentication failure</b>; logname= uid=0 euid=0 tty=dovecot <a href="mailto:ruser=user1@company.com" class="">ruser=user1@company.com</a> rhost=::1 <a href="mailto:user=user1@company.com" class="">user=user1@company.com</a><br class="">Jun 1 17:38:37 mail auth: <b class="">pam_sss</b>(dovecot:auth): <b class="">authentication success</b>; logname= uid=0 euid=0 tty=dovecot ruser=user1@company.com rhost=::1 user=user1@company.com</div><div class=""><div apple-content-edited="true" class=""><br class=""></div><div apple-content-edited="true" class="">
But when user is logged in, “id” command result is instantaneous.</div><div apple-content-edited="true" class="">All machines have selinux enabled, of course.</div><div apple-content-edited="true" class=""><br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; " class="">Thanks in advance,</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; " class=""><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; " class="">Ivars</span></div>
<br class=""></div><div class="">sssd.conf file from client:</div><div class=""><br class=""></div><div class="">[domain/<a href="http://company.com" class="">company.com</a>]<br class=""><br class="">cache_credentials = True<br class="">krb5_store_password_if_offline = True<br class="">ipa_domain = <a href="http://company.com" class="">company.com</a><br class="">id_provider = ipa<br class="">auth_provider = ipa<br class="">access_provider = ipa<br class="">ipa_hostname = <a href="http://mail.company.com" class="">mail.company.com</a><br class="">chpass_provider = ipa<br class="">ipa_server = <a href="http://server1.company.com" class="">server1.company.com</a>, _srv_<br class="">ldap_tls_cacert = /etc/ipa/ca.crt<br class="">enumerate = true<br class="">[sssd]<br class="">services = nss, sudo, pam, ssh<br class="">config_file_version = 2<br class=""><br class="">domains = <a href="http://company.com" class="">company.com</a><br class="">[nss]<br class="">homedir_substring = /home<br class=""><br class="">[pam]<br class=""><br class="">[sudo]<br class=""><br class="">[autofs]<br class=""><br class="">[ssh]<br class=""><br class="">[pac]<br class=""><br class="">[ifp]</div></body></html>