<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <html> <head> <meta name="generator" content="HTML Tidy for Windows (vers 25 March 2009), see www.w3.org"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="MS Exchange Server version 08.03.0389.002"> <title>Re: [Freeipa-users] Really slow logins with AD SID Mapping vs. POSIX</title> </head> <body> You are correct. 7.1. Sent with Good (www.good.com) -----Original Message----- From: Jakub Hrozek [<a href="mailto:jhrozek@redhat.com">jhrozek@redhat.com</a>] Sent: Thursday, March 19, 2015 11:37 AM Eastern Standard Time To: Gould, Joshua Cc: freeipa-users@redhat.com Subject: Re: [Freeipa-users] Really slow logins with AD SID Mapping vs. POSIX  On Thu, Mar 19, 2015 at 11:31:16AM -0400, Gould, Joshua wrote: > RHEL 7.0 fully up to date. Are you sure? Looks like 7.1 to me based on the NVRs. > > sssd-krb5-common-1.12.2-58.el7.x86_64 > sssd-ipa-1.12.2-58.el7.x86_64 > sssd-1.12.2-58.el7.x86_64 > sssd-tools-1.12.2-58.el7.x86_64 > sssd-common-1.12.2-58.el7.x86_64 > sssd-ad-1.12.2-58.el7.x86_64 > sssd-krb5-1.12.2-58.el7.x86_64 > sssd-ldap-1.12.2-58.el7.x86_64 > sssd-client-1.12.2-58.el7.x86_64 > sssd-common-pac-1.12.2-58.el7.x86_64 > sssd-proxy-1.12.2-58.el7.x86_64 > > > > On 3/19/15, 11:23 AM, "Jakub Hrozek" <jhrozek@redhat.com> wrote: > > >On Thu, Mar 19, 2015 at 11:05:45AM -0400, Gould, Joshua wrote: > >> I¹m seeing ssh logins for AD users take MUCH longer when using SID > >>mapping > >> vs. POSIX attributes. Both myself and our AD admin would prefer to use > >>SID > >> mapping. It appears tied to the group lookup at login. There seem to be > >> many posts about it, but I haven¹t found anything to help much. sssd > >>pegs > >> the CPU for the 15 or so seconds the login takes. > > > >You haven't said what OS or release are you running, but for 7.0 I have > >test packages with a proposed enhancement Sumit wrote: > > > ><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__jhrozek.fedorapeople">https://urldefense.proofpoint.com/v2/url?u=https-3A__jhrozek.fedorapeople</a>. > >org_sssd-2Dtest-2Dbuilds_sssd-2D7.0-2Dlogin-2Dspeedup_&d=AwIFAw&c=k9MF1d71 > >ITtkuJx-PdWme51dKbmfPEvxwt8SFEkBfs4&r=C8H0y1Bn8C6Mf5i9qrqkUDy3xSk8zPbIs_Sv > >JwojC24&m=YA1l-b8irE5VE9qVc1q4PY8RVJA2iLwWLK_U7aXS1gs&s=bYcFLFGsd6BT_1ozcn > >1r1WaYFWJ4_5xT5ddR7d45Z08&e= > > > >Please include the versions of the problematic packages in the future > >requests for troubleshooting. > > > >-- > >Manage your subscription for the Freeipa-users mailing list: > ><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.redhat.com_mailma">https://urldefense.proofpoint.com/v2/url?u=https-3A__www.redhat.com_mailma</a> > >n_listinfo_freeipa-2Dusers&d=AwIFAw&c=k9MF1d71ITtkuJx-PdWme51dKbmfPEvxwt8S > >FEkBfs4&r=C8H0y1Bn8C6Mf5i9qrqkUDy3xSk8zPbIs_SvJwojC24&m=YA1l-b8irE5VE9qVc1 > >q4PY8RVJA2iLwWLK_U7aXS1gs&s=uJUobRCfTZ-jS6M4XSLW8ScMXv_1sIQ-OSoy54M7b2k&e= > > > >Go to > ><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__freeipa.org&d=AwIFAw&c">https://urldefense.proofpoint.com/v2/url?u=http-3A__freeipa.org&d=AwIFAw&c</a> > >=k9MF1d71ITtkuJx-PdWme51dKbmfPEvxwt8SFEkBfs4&r=C8H0y1Bn8C6Mf5i9qrqkUDy3xSk > >8zPbIs_SvJwojC24&m=YA1l-b8irE5VE9qVc1q4PY8RVJA2iLwWLK_U7aXS1gs&s=F_LQz74bb > >hG6_BKutjgbdRMTvIBRYggIgNj1QZoEznw&e= for more info on the project > </body> </html>