[Freeipa-users] 'Preauthentication failed' with SSSD in ipa_server_mode

[Jakub Hrozek]

On Tue, Mar 24, 2015 at 08:10:43PM +0100, Bobby Prins wrote:
> > I guess what Alexander meant (in a very simplified way) was that the 'id'
> > command could take a long time. Sumit recently fixed two nasty issues that
> > would make this operation take too long with POSIX attributes in effect
> > and also that the initgroups operation might be done too frequently with
> > SSH. I wonder if you might be seeing this issue, the SSSD logs capturing
> > the login on the server side would help.
> Yeah, I noticed the other thread about slow logins a couple of days ago. The ‘id’ command takes 5 to 10 seconds on the IPA server for a couple of accounts I tested with (50 to 60 group memberships, some with a lot of/300+ members). I’m not using 'Identity Management for UNIX’ on Windows if that’s what you mean. I’ll try to clean up (read: remove customer data) the SSSD logs a bit tomorrow so I can post them.

Ah, thank you, then it's unlikely either of the two bugs affect you.