realm join taking more than 5 minutes - waiting on password which was already entered

In a few cases recently (again yesterday), we noticed RHEL7.3's "realm join"
taking more than 5
minutes (which timed out in our cli, and running realm directly worked but took ~6 minutes
when
normally would take a few seconds). As you can see from the verbose output below the
two longest stretches (greater than 2 minutes! each) were waiting between launching
"net ads join" and piping the password in (and similarly "net ads keytab
create" had a long delay between starting the command and giving it the password). 
Looking at realmd service/realm-samba-enroll.c e.g. begin_net_process() calling out to
realm_command_runv_async it was not obvious why there should be any delay between the
launch of the net command the passing of the password (I did see one report of "net
ads keytab create" hanging if the keytab already existed but that is not the same
problem as this). Any idea how/why such long delays between launching net and inputting
the password in realmd async code? > 5 minutes is a long time to do something that
usually completes in 10 seconds

2017-08-01 19:54:09 realmd[14197]: * Performing LDAP DSE lookup on: ...
2017-08-01 19:54:09 realmd[14197]: * Successfully discovered ...
2017-08-01 19:54:10 realmd[14197]: * Required files: /usr/sbin/oddjobd,
/usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
2017-08-01 19:54:10 realmd[14197]: * Joining using a manual netbios name: ....
2017-08-01 19:54:10 realmd[14197]: * LANG=C LOGNAME=root /usr/bin/net -s
/var/cache/realmd/realmd-smb-conf.0DFU4Y -U <username> ads join <domain>
2017-08-01 19:56:42 realmd[14197]: Enter <username's> password: 
2017-08-01 19:56:42 realmd[14197]: Using short domain name -- <short name>
2017-08-01 19:56:42 realmd[14197]: Joined ... to dns domain ...
2017-08-01 19:56:42 realmd[14197]: * LANG=C LOGNAME=root /usr/bin/net -s
/var/cache/realmd/realmd-smb-conf.0DFU4Y -U <username> ads keytab create
2017-08-01 19:59:33 realmd[14197]: Enter <username's> password:

Any ideas why realmd's async processing (basically passing the password to
the underlying "net ads join" etc.) is doing this?

[Justin Stephenson]

On 08/08/2017 08:44 PM, smfrench(a)gmail.com wrote:
>  In a few cases recently (again yesterday), we noticed RHEL7.3's
> "realm join" taking more than 5
>  minutes (which timed out in our cli, and running realm directly worked but took ~6
> minutes when
>  normally would take a few seconds). As you can see from the verbose output below the
>  two longest stretches (greater than 2 minutes! each) were waiting between launching
>  "net ads join" and piping the password in (and similarly "net ads keytab
>  create" had a long delay between starting the command and giving it the password).
>  Looking at realmd service/realm-samba-enroll.c e.g. begin_net_process() calling out to
>  realm_command_runv_async it was not obvious why there should be any delay between the
>  launch of the net command the passing of the password (I did see one report of "net
>  ads keytab create" hanging if the keytab already existed but that is not the same
>  problem as this). Any idea how/why such long delays between launching net and inputting
>  the password in realmd async code? > 5 minutes is a long time to do something that
>  usually completes in 10 seconds
>  
>  2017-08-01 19:54:09 realmd[14197]: * Performing LDAP DSE lookup on: ...
>  2017-08-01 19:54:09 realmd[14197]: * Successfully discovered ...
>  2017-08-01 19:54:10 realmd[14197]: * Required files: /usr/sbin/oddjobd,
>  /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
>  2017-08-01 19:54:10 realmd[14197]: * Joining using a manual netbios name: ....
>  2017-08-01 19:54:10 realmd[14197]: * LANG=C LOGNAME=root /usr/bin/net -s
>  /var/cache/realmd/realmd-smb-conf.0DFU4Y -U <username> ads join <domain>
>  2017-08-01 19:56:42 realmd[14197]: Enter <username's> password:
>  2017-08-01 19:56:42 realmd[14197]: Using short domain name -- <short name>
>  2017-08-01 19:56:42 realmd[14197]: Joined ... to dns domain ...
>  2017-08-01 19:56:42 realmd[14197]: * LANG=C LOGNAME=root /usr/bin/net -s
>  /var/cache/realmd/realmd-smb-conf.0DFU4Y -U <username> ads keytab create
>  2017-08-01 19:59:33 realmd[14197]: Enter <username's> password:
>  
>  Any ideas why realmd's async processing (basically passing the password to
>  the underlying "net ads join" etc.) is doing this? 
I would use the method mentioned in the below email thread to add the 
-d10 argument to the net command and keep all other parameters the same 
as a typical realm join then analyze the net debug output to see what is 
taking the longest time.

https://lists.fedorahosted.org/archives/list/[e-mail]...

Kind regards,
Justin Stephenson

> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>

Additional information - calling "net ads join" directly (instead of using realm
join) with similar parms - worked and went fast.