How to change the timeout of 60 seconds on the login with AD users

[SOLER SANGUESA Miguel]

Hello,

After a primary DNS server problem, I have realized that the IDM client has a timeout of
60 s for the log in.
As the primary DNS was not working, server used the secondary DNS and it takes 4s for
resolving any name, as I use AD users, on the authentication phase, all AD servers must be
translated (9 servers) so it makes the authentication very slow and timeout of 60 s is
triggered. I have modified the resolv.conf to make the transition to the second DNS server
faster (resolving any name takes 2s), and then authentication is done on 48s so it works.
But what I want to know is how to modify those 60s of timeout. I have checked the logs
with debug_level = 9 and I don't see the "timeout" log.
I have also changed (on client side):
krb5_auth_timeout = 190
pam_id_timeout = 190
but it still have the timeout at 60s

the client is:
RHEL 6.10 (but I think it happens the same on RHEL 7)
sssd-client-1.13.3-60.el6_10.2.x86_64
ipa-client-3.0.0-51.el6.x86_64

sssd.conf:
[domain/IPAdomain]
krb5_auth_timeout = 190
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = IPAdomain
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ldap_tls_cacert = /etc/ipa/ca.crt
ipa_hostname = CLIENT.domain.org
chpass_provider = ipa
ipa_server = _srv_, IPASERVER1, IPASERVER2
dns_discovery_domain = IPAdomain
[sssd]
config_file_version = 2
services = nss, sudo, pam, ssh
domains = IPAdomain
default_domain_suffix = AD.domain
[nss]
filter_groups = root
filter_users = root,iccsecure,tomcat,oracle
reconnection_retries = 3
[pam]
reconnection_retries = 3
pam_id_timeout = 190
[sudo]
[ssh]

On the Server side:
RHEL 7.6
sssd-1.16.2-13.el7_6.8.x86_64
ipa-server-4.6.4-10.el7_6.3.x86_64

sssd.conf:
[domain/IPAdomain]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = IPAdomain
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = IPASERVER1
chpass_provider = ipa
ipa_server = IPASERVER1
ipa_server_mode = True
ldap_tls_cacert = /etc/ipa/ca.crt
subdomain_homedir = %o
[sssd]
config_file_version = 2
services = nss, sudo, pam, ssh
domains = IPAdomain
[domain/IPAdomain/ADdomain]
ldap_search_base = ou=XXX,dc=XXXX,dc=XXXXX,dc=XXX
[nss]
filter_groups = root
filter_users = root, iccsecure, tomcat, oracle
reconnection_retries = 3
memcache_timeout = 600
homedir_substring = /home
[pam]
reconnection_retries = 3
[ssh]
[sudo]

I have attached the logs, timeout is triggered at 12:21:50

Thanks & Regards.

[Sumit Bose]

On Thu, Oct 03, 2019 at 10:48:40AM +0000, SOLER SANGUESA Miguel via FreeIPA-users wrote:
>  Hello,
>  
>  After a primary DNS server problem, I have realized that the IDM client has a timeout of
> 60 s for the log in.
>  As the primary DNS was not working, server used the secondary DNS and it takes 4s for
> resolving any name, as I use AD users, on the authentication phase, all AD servers must be
> translated (9 servers) so it makes the authentication very slow and timeout of 60 s is
> triggered. I have modified the resolv.conf to make the transition to the second DNS server
> faster (resolving any name takes 2s), and then authentication is done on 48s so it works.
>  But what I want to know is how to modify those 60s of timeout. I have checked the logs
> with debug_level = 9 and I don't see the "timeout" log.
>  I have also changed (on client side):
>  krb5_auth_timeout = 190
>  pam_id_timeout = 190
>  but it still have the timeout at 60s 
Hi,

how do you try to log in?

There is LOGIN_TIMEOUT in /etc/login.defs, see man login.defs for
details.

HTH

bye,
Sumit

>  
>  the client is:
>  RHEL 6.10 (but I think it happens the same on RHEL 7)
>  sssd-client-1.13.3-60.el6_10.2.x86_64
>  ipa-client-3.0.0-51.el6.x86_64
>  
>  sssd.conf:
>  [domain/IPAdomain]
>  krb5_auth_timeout = 190
>  cache_credentials = True
>  krb5_store_password_if_offline = True
>  ipa_domain = IPAdomain
>  id_provider = ipa
>  auth_provider = ipa
>  access_provider = ipa
>  ldap_tls_cacert = /etc/ipa/ca.crt
>  ipa_hostname = CLIENT.domain.org
>  chpass_provider = ipa
>  ipa_server = _srv_, IPASERVER1, IPASERVER2
>  dns_discovery_domain = IPAdomain
>  [sssd]
>  config_file_version = 2
>  services = nss, sudo, pam, ssh
>  domains = IPAdomain
>  default_domain_suffix = AD.domain
>  [nss]
>  filter_groups = root
>  filter_users = root,iccsecure,tomcat,oracle
>  reconnection_retries = 3
>  [pam]
>  reconnection_retries = 3
>  pam_id_timeout = 190
>  [sudo]
>  [ssh]
>  
>  On the Server side:
>  RHEL 7.6
>  sssd-1.16.2-13.el7_6.8.x86_64
>  ipa-server-4.6.4-10.el7_6.3.x86_64
>  
>  sssd.conf:
>  [domain/IPAdomain]
>  cache_credentials = True
>  krb5_store_password_if_offline = True
>  ipa_domain = IPAdomain
>  id_provider = ipa
>  auth_provider = ipa
>  access_provider = ipa
>  ipa_hostname = IPASERVER1
>  chpass_provider = ipa
>  ipa_server = IPASERVER1
>  ipa_server_mode = True
>  ldap_tls_cacert = /etc/ipa/ca.crt
>  subdomain_homedir = %o
>  [sssd]
>  config_file_version = 2
>  services = nss, sudo, pam, ssh
>  domains = IPAdomain
>  [domain/IPAdomain/ADdomain]
>  ldap_search_base = ou=XXX,dc=XXXX,dc=XXXXX,dc=XXX
>  [nss]
>  filter_groups = root
>  filter_users = root, iccsecure, tomcat, oracle
>  reconnection_retries = 3
>  memcache_timeout = 600
>  homedir_substring = /home
>  [pam]
>  reconnection_retries = 3
>  [ssh]
>  [sudo]
>  
>  I have attached the logs, timeout is triggered at 12:21:50
>  
>  Thanks & Regards. 





>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...