8.5. Tuning SSSD in IdM clients for large IdM-AD trust deployments

Procédure

1. Determine the number of seconds a single un-cached login takes.

   1. Clear the SSSD cache on the IdM client client.example.com.

      [root@client ~]# sss_cache -E

   2. Measure how long it takes to log in as an AD user with the time command. In this example, from the IdM client client.example.com, log into the same host as the user ad-user from the ad.example.com AD domain.

      [root@client ~]# time ssh ad-user@ad.example.com@client.example.com

   3. Type in the password as soon as possible.

      Password:
      Last login: Sat Jan 23 06:29:54 2021 from 10.0.2.15
      [ad-user@ad.example.com@client ~]$

   4. Log out as soon as possible to display elapsed time. In this example, a single un-cached login takes about 9 seconds.

      [ad-user@ad.example.com@client /]$ exit
      logout
      Connection to client.example.com closed.
      
      real 0m8.755s
      user    0m0.017s
      sys     0m0.013s

2. Ouvrez le fichier de configuration /etc/sssd/sssd.conf dans un éditeur de texte.

3. Add the following options to the [domain] section for your Active Directory domain. Set the pam_id_timeout and krb5_auth_timeout options to the number of seconds an un-cached login takes. If you do not already have a domain section for your AD domain, create one.

   [domain/example.com/ad.example.com]
   krb5_auth_timeout = 9
   ldap_deref_threshold = 0
   ...

4. Add the following option to the [pam] section:

   [pam]
   pam_id_timeout = 9

5. Save and close the /etc/sssd/sssd.conf file on the server.

6. Redémarrez le service SSSD pour charger les modifications de configuration.

   [root@client ~]# systemctl restart sssd