9.5. Tuning SSSD in IdM clients for large IdM-AD trust deployments

Procedure

1. Determine the number of seconds a single un-cached login takes.

   1. Clear the SSSD cache on the IdM client.

      [root@client_hostname ~]# sss_cache -E

   2. Measure login time for an AD user using the time command. From the IdM client, authenticate locally as an AD user by logging into the same host.

      [root@client_hostname ~]# time ssh <ad_username>@<ad_domain>@<client_fqdn>

   3. Type in the password as soon as possible.

      Password:
      Last login: Sat Jan 23 06:29:54 2021 from 10.0.2.15
      [ad_username@ad_domain@client_fqdn ~]$

   4. Log out as soon as possible to display elapsed time. In this example, a single un-cached login takes about 9 seconds.

      [ad_username@ad_domain@client_fqdn /]$ exit
      logout
      Connection to client.example.com closed.
      
      real 0m8.755s
      user    0m0.017s
      sys     0m0.013s

2. Open the /etc/sssd/sssd.conf configuration file in a text editor.

3. Add the following options to the [domain] section for your Active Directory domain. Set the pam_id_timeout and krb5_auth_timeout options to the number of seconds an un-cached login takes. If you do not already have a domain section for your AD domain, create one.

   [domain/<idm_domain>/<ad_domain>]
   krb5_auth_timeout = 9
   ldap_deref_threshold = 0
   ...

4. Add the following option to the [pam] section:

   [pam]
   pam_id_timeout = 9

5. Save and close the /etc/sssd/sssd.conf file on the server.

6. Restart the SSSD service to load the configuration changes.

   [root@client_hostname ~]# systemctl restart sssd