On Wed, Mar 06, 2019 at 11:24:20PM -0000, Charles Ulrich via
FreeIPA-users wrote:
In the log snippet the client runs into a timeout, the IPA server didn't
send a reply for 6s. Since you say that you can authenticate in general
on the client I guess this might only a temporary error because e.g. the
server had to refresh its own cache. But you can try to increase
ldap_search_timeout in sssd.conf, see man sssd-ldap for details.
Thanks for the suggestions. I set ldap_search_timeout to 60 and the ssh_authorized_keys
command still times out, although it took a bit longer than before (about 20 seconds now).
I added ldap_network_timeout = 60 and ldap_opt_timeout = 60 with no change. I made sure to
restart sssd after each change.
Is there any way to troubleshoot exactly what sss_ssh_authorizedkeys is doing? I don't
see a debug or verbose flag in the documentation. I assume it's doing an LDAP lookup,
can I replicate that somehow with ldapsearch?
In case you are using 'full_name_format = %1$s' in sssd.conf
on the IPA
servers as well please remove it, this option is not supported on IPA
server.
I checked to be sure that this is only defined on the client.
Thanks,
Charles