Chapter 9. Tuning SSSD performance for large IdM-AD trust deployments

Procedure

1. Open the /etc/sssd/sssd.conf configuration file in a text editor.

2. Add the following options to the [domain] section for your Identity Management (IdM) domain:

   [domain/idm.example.com]
   ignore_group_members = true
   subdomain_inherit = ignore_group_members
   ...

   Note

   Settings listed in the subdomain_inherit options apply to both the main (IdM) domain as well as the trusted AD domain(s).

3. Save and close the /etc/sssd/sssd.conf file on the server.

4. Restart the SSSD service to load the configuration changes.

   [root@client ~]# systemctl restart sssd

Procedure

1. Retrieve the total number of worker threads:

   # ldapsearch -xLLLD cn=directory\ manager -W -b cn=config -s base nsslapd-threadnumber
   Enter LDAP Password:
   dn: cn=config
   nsslapd-threadnumber: 16

   This means that the current value for ipaExtdomMaxInstances is 13.

2. Adjust the maximum number of instances. This example changes the value to 14:

   # ldapmodify -D "cn=directory manager" -W
   dn: cn=ipa_extdom_extop,cn=plugins,cn=config
   changetype: modify
   replace: ipaExtdomMaxInstances
   ipaExtdomMaxInstances: 14

3. Retrieve the current value of ipaExtdomMaxInstances:

   # ldapsearch -xLLLD "cn=directory manager" -W -b "cn=ipa_extdom_extop,cn=plugins,cn=config" |grep ipaextdommaxinstances
   
   Enter LDAP Password:
   
   ipaextdommaxinstances: 14

4. Monitor the IdM directory server’s performance and if it does not improve, repeat this procedure and adjust the value of the ipaExtdomMaxInstances variable.

Procedure

1. Determine the number of seconds a single un-cached login takes.

   1. Clear the SSSD cache on the IdM client client.example.com.

      [root@client ~]# sss_cache -E

   2. Measure how long it takes to log in as an AD user with the time command. In this example, from the IdM client client.example.com, log into the same host as the user ad-user from the ad.example.com AD domain.

      [root@client ~]# time ssh ad-user@ad.example.com@client.example.com

   3. Type in the password as soon as possible.

      Password:
      Last login: Sat Jan 23 06:29:54 2021 from 10.0.2.15
      [ad-user@ad.example.com@client ~]$

   4. Log out as soon as possible to display elapsed time. In this example, a single un-cached login takes about 9 seconds.

      [ad-user@ad.example.com@client /]$ exit
      logout
      Connection to client.example.com closed.
      
      real 0m8.755s
      user    0m0.017s
      sys     0m0.013s

2. Open the /etc/sssd/sssd.conf configuration file in a text editor.

3. Add the following options to the [domain] section for your Active Directory domain. Set the pam_id_timeout and krb5_auth_timeout options to the number of seconds an un-cached login takes. If you do not already have a domain section for your AD domain, create one.

   [domain/example.com/ad.example.com]
   krb5_auth_timeout = 9
   ldap_deref_threshold = 0
   ...

4. Add the following option to the [pam] section:

   [pam]
   pam_id_timeout = 9

5. Save and close the /etc/sssd/sssd.conf file on the server.

6. Restart the SSSD service to load the configuration changes.

   [root@client ~]# systemctl restart sssd

Procedure

1. Create a tmpfs temporary filesystem:

   1. On RHEL 8.6 and later, confirm that the SSSD user owns the config.ldb file:

      # ls -al /var/lib/sss/db/config.ldb
      -rw-------. 1 sssd sssd 1286144 Jun  8 16:41 /var/lib/sss/db/config.ldb

      Add the following entry to the /etc/fstab file as a single line:

      tmpfs /var/lib/sss/db/ tmpfs size=300M,mode=0700,uid=sssd,gid=sssd,rootcontext=system_u:object_r:sssd_var_lib_t:s0 0 0

   2. On RHEL 8 versions lower than 8.6, the config.ldb file is owned by the root user:

      # ls -al /var/lib/sss/db/config.ldb
      -rw-------. 1 root root 1286144 Jun  8 14:15 /var/lib/sss/db/config.ldb

      Add the following entry to the /etc/fstab file as a single line:

      tmpfs /var/lib/sss/db/ tmpfs size=300M,mode=0700,rootcontext=system_u:object_r:sssd_var_lib_t:s0 0 0

      This example creates a 300MB cache. Tune the size parameter according to your IdM and AD directory size, estimating 100 MBs per 10,000 LDAP entries.

2. Mount the new SSSD cache directory.

   [root@host ~]# mount /var/lib/sss/db/

3. Restart SSSD to reflect this configuration change.

   [root@host ~]# systemctl restart sssd