<html><body><div style="color: rgb(0, 0, 0); font-family: arial,helvetica,sans-serif; font-size: 12pt;"><div>Hi there<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>I'm trying to debug on a strange IPA timeout issue.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Its SSSD 1.14, IPA 4.4, RHEL 7.3.<br data-mce-bogus="1"></div><div>2 IPA servers in AD trust.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Besides being a bit slow on groups membership lookups on users with a moderate number of Groups, there are some users with a HUGE amount of nested groups.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>A server just installed, thereby having clean cache:<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div><p style="margin: 0px;" data-mce-style="margin: 0px;"># time id shja<br>id: shja: no such user</p><p style="margin: 0px;" data-mce-style="margin: 0px;">real 0m12.107s<br>user 0m0.000s<br>sys 0m0.007s<br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">Hmm, lets try again:</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"># sss_cache -E && systemctl restart sssd</p><p style="margin: 0px;" data-mce-style="margin: 0px;"># time id shja<br>id: shja: no such user</p><p style="margin: 0px;" data-mce-style="margin: 0px;">real 0m58.016s<br>user 0m0.001s<br>sys 0m0.005s<br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">Hmm..</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"># sss_cache -E && systemctl restart sssd</p><p style="margin: 0px;" data-mce-style="margin: 0px;"># time id shja</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">...about 30% of the users Groups are returned....</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">real 5m16.840s<br>user 0m0.010s<br>sys 0m0.019s</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">Next lookup is pretty fast and returns all Groups (about 730).</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"># time id shja</p><p style="margin: 0px;" data-mce-style="margin: 0px;">real 0m7.670s<br>user 0m0.028s<br>sys 0m0.066s</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">A few questions.</p><p style="margin: 0px;" data-mce-style="margin: 0px;">The first times id seems to bail out and report no such user after whet seems to be a random amount of time.</p><p style="margin: 0px;" data-mce-style="margin: 0px;">Then is actually starts fetching groups it fetches a portion of the Groups, and the last try it fetches all groups.</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">It looks like IPA is starting a thread running in backgroups, filling the cache and this continues after the failed lookup?</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">Shouldn't SSSD be able to use the cache from the the SSSD on the IPA server?</p><p style="margin: 0px;" data-mce-style="margin: 0px;">In this example the IPA server had full cache of the user and groups but the time it took to do the lookup indicates its still traversing the AD?</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">sssd.conf is pretty default:</p><p style="margin: 0px;" data-mce-style="margin: 0px;">full_name_format = %1$s</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">set on SSSD client.</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">On IPA server this is added (no full_name_format):<br data-mce-bogus="1"></p><p style="margin: 0px;" data-mce-style="margin: 0px;">ignore_group_members = True<br>ldap_purge_cache_timeout = 0<br>ldap_user_principal = nosuchattr</p><p style="margin: 0px;" data-mce-style="margin: 0px;">subdomain_inherit = ldap_user_principal, ignore_group_members, ldap_purge_cache_timeout</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br data-mce-bogus="1"></p></div></div></body></html>