Bug 743925

Summary:	HBAC processing is very slow when dealing with FreeIPA deployments with large numbers of hosts.
Product:	Red Hat Enterprise Linux 6	Reporter:	Dmitri Pal <dpal>
Component:	sssd	Assignee:	Stephen Gallagher <sgallagh>
Status:	CLOSED ERRATA	QA Contact:	IDM QE LIST <seceng-idm-qe-list>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.1	CC:	grajaiya, jgalipea, jhrozek, jr.aquino, prc, sbose, sgallagh, ssorce
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:	sssd-1.5.1-59.el6	Doc Type:	Bug Fix
Doc Text:	Do not document	Story Points:	---
Clone Of:	743035
Clones:	748897 (view as bug list)		Environment:
Last Closed:	2011-12-06 16:40:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	743035
Bug Blocks:	748554, 748897

Description Dmitri Pal 2011-10-06 13:30:09 UTC

+++ This bug was initially created as a clone of Bug #743035 +++

Description of problem:
When logging into an sssd client to a freeipa system who has many hosts, the delay in authorization can take over 30seconds for ssh and sudo

Version-Release number of selected component (if applicable):
sssd 1.5.x

How reproducible:
100%

Steps to Reproduce:
1. Create a FreeIPA install with over 1000 hosts + hostgroups + hbacrules
2. Login to a client
3. Note very long delay in processing
  
Actual results:
30second + delay in authorizations

Expected results:
Much faster processing

Additional info:

--- Additional comment from sgallagh on 2011-10-03 13:02:12 EDT ---

Upstream ticket:
https://fedorahosted.org/sssd/ticket/1029

Comment 2 Gowrishankar Rajaiyan 2011-10-17 08:46:52 UTC

Version: sssd-1.5.1-58.el6.x86_64

Regression found while verifying. Crash detected during authentication.



[root@qe-blade-04 ~]# gdb --core=/var/spool/abrt/ccpp-2011-10-17-02\:53\:03-14471/coredump /usr/libexec/sssd/sssd_be --quiet -ex "thread apply all bt full" -ex "quit"
Reading symbols from /usr/libexec/sssd/sssd_be...Reading symbols from /usr/lib/debug/usr/libexec/sssd/sssd_be.debug...done.
done.
[New Thread 14471]
Missing separate debuginfo for 
Try: yum --disablerepo='*' --enablerepo='*-debuginfo' install /usr/lib/debug/.build-id/cd/1f50f124b7a290fec8570580296ce761a25781
Reading symbols from /lib64/libpam.so.0.82.2...Reading symbols from /usr/lib/debug/lib64/libpam.so.0.82.2.debug...done.
done.
Loaded symbols for /lib64/libpam.so.0.82.2
Reading symbols from /usr/lib64/libtevent.so.0.9.8...Reading symbols from /usr/lib/debug/usr/lib64/libtevent.so.0.9.8.debug...done.
done.
Loaded symbols for /usr/lib64/libtevent.so.0.9.8
Reading symbols from /usr/lib64/libtalloc.so.2.0.1...Reading symbols from /usr/lib/debug/usr/lib64/libtalloc.so.2.0.1.debug...done.
done.
Loaded symbols for /usr/lib64/libtalloc.so.2.0.1
Reading symbols from /lib64/libpopt.so.0.0.0...Reading symbols from /usr/lib/debug/lib64/libpopt.so.0.0.0.debug...done.
done.
Loaded symbols for /lib64/libpopt.so.0.0.0
Reading symbols from /usr/lib64/libldb.so.0.9.10...Reading symbols from /usr/lib/debug/usr/lib64/libldb.so.0.9.10.debug...done.
done.
Loaded symbols for /usr/lib64/libldb.so.0.9.10
Reading symbols from /lib64/libdbus-1.so.3.4.0...Reading symbols from /usr/lib/debug/lib64/libdbus-1.so.3.4.0.debug...done.
done.
Loaded symbols for /lib64/libdbus-1.so.3.4.0
Reading symbols from /lib64/librt-2.12.so...Reading symbols from /usr/lib/debug/lib64/librt-2.12.so.debug...done.
done.
Loaded symbols for /lib64/librt-2.12.so
Reading symbols from /lib64/libpcre.so.0.0.1...Reading symbols from /usr/lib/debug/lib64/libpcre.so.0.0.1.debug...done.
done.
Loaded symbols for /lib64/libpcre.so.0.0.1
Reading symbols from /usr/lib64/libini_config.so.2.0.0...Reading symbols from /usr/lib/debug/usr/lib64/libini_config.so.2.0.0.debug...done.
done.
Loaded symbols for /usr/lib64/libini_config.so.2.0.0
Reading symbols from /usr/lib64/libcollection.so.2.0.0...Reading symbols from /usr/lib/debug/usr/lib64/libcollection.so.2.0.0.debug...done.
done.
Loaded symbols for /usr/lib64/libcollection.so.2.0.0
Reading symbols from /usr/lib64/libdhash.so.1.0.0...Reading symbols from /usr/lib/debug/usr/lib64/libdhash.so.1.0.0.debug...done.
done.
Loaded symbols for /usr/lib64/libdhash.so.1.0.0
Reading symbols from /lib64/liblber-2.4.so.2.5.6...Reading symbols from /usr/lib/debug/lib64/liblber-2.4.so.2.5.6.debug...done.
done.
Loaded symbols for /lib64/liblber-2.4.so.2.5.6
Reading symbols from /lib64/libldap-2.4.so.2.5.6...Reading symbols from /usr/lib/debug/lib64/libldap-2.4.so.2.5.6.debug...done.
done.
Loaded symbols for /lib64/libldap-2.4.so.2.5.6
Reading symbols from /usr/lib64/libtdb.so.1.2.1...Reading symbols from /usr/lib/debug/usr/lib64/libtdb.so.1.2.1.debug...done.
done.
Loaded symbols for /usr/lib64/libtdb.so.1.2.1
Reading symbols from /usr/lib64/libssl3.so...Reading symbols from /usr/lib/debug/usr/lib64/libssl3.so.debug...done.
done.
Loaded symbols for /usr/lib64/libssl3.so
Reading symbols from /usr/lib64/libsmime3.so...Reading symbols from /usr/lib/debug/usr/lib64/libsmime3.so.debug...done.
done.
Loaded symbols for /usr/lib64/libsmime3.so
Reading symbols from /usr/lib64/libnss3.so...Reading symbols from /usr/lib/debug/usr/lib64/libnss3.so.debug...done.
done.
Loaded symbols for /usr/lib64/libnss3.so
Reading symbols from /usr/lib64/libnssutil3.so...Reading symbols from /usr/lib/debug/usr/lib64/libnssutil3.so.debug...done.
done.
Loaded symbols for /usr/lib64/libnssutil3.so
Reading symbols from /lib64/libplds4.so...Reading symbols from /usr/lib/debug/lib64/libplds4.so.debug...done.
done.
Loaded symbols for /lib64/libplds4.so
Reading symbols from /lib64/libplc4.so...Reading symbols from /usr/lib/debug/lib64/libplc4.so.debug...done.
done.
Loaded symbols for /lib64/libplc4.so
Reading symbols from /lib64/libnspr4.so...Reading symbols from /usr/lib/debug/lib64/libnspr4.so.debug...done.
done.
Loaded symbols for /lib64/libnspr4.so
Reading symbols from /lib64/libpthread-2.12.so...Reading symbols from /usr/lib/debug/lib64/libpthread-2.12.so.debug...done.
[Thread debugging using libthread_db enabled]
done.
Loaded symbols for /lib64/libpthread-2.12.so
Reading symbols from /lib64/libdl-2.12.so...Reading symbols from /usr/lib/debug/lib64/libdl-2.12.so.debug...done.
done.
Loaded symbols for /lib64/libdl-2.12.so
Reading symbols from /usr/lib64/libcares.so.2.0.0...Reading symbols from /usr/lib/debug/usr/lib64/libcares.so.2.0.0.debug...done.
done.
Loaded symbols for /usr/lib64/libcares.so.2.0.0
Reading symbols from /lib64/libc-2.12.so...Reading symbols from /usr/lib/debug/lib64/libc-2.12.so.debug...done.
done.
Loaded symbols for /lib64/libc-2.12.so
Reading symbols from /lib64/libaudit.so.1.0.0...Reading symbols from /usr/lib/debug/lib64/libaudit.so.1.0.0.debug...done.
done.
Loaded symbols for /lib64/libaudit.so.1.0.0
Reading symbols from /lib64/libcrypt-2.12.so...Reading symbols from /usr/lib/debug/lib64/libcrypt-2.12.so.debug...done.
done.
Loaded symbols for /lib64/libcrypt-2.12.so
Reading symbols from /lib64/ld-2.12.so...Reading symbols from /usr/lib/debug/lib64/ld-2.12.so.debug...done.
done.
Loaded symbols for /lib64/ld-2.12.so
Reading symbols from /usr/lib64/libpath_utils.so.1.0.0...Reading symbols from /usr/lib/debug/usr/lib64/libpath_utils.so.1.0.0.debug...done.
done.
Loaded symbols for /usr/lib64/libpath_utils.so.1.0.0
Reading symbols from /usr/lib64/libref_array.so.1.0.0...Reading symbols from /usr/lib/debug/usr/lib64/libref_array.so.1.0.0.debug...done.
done.
Loaded symbols for /usr/lib64/libref_array.so.1.0.0
Reading symbols from /lib64/libresolv-2.12.so...Reading symbols from /usr/lib/debug/lib64/libresolv-2.12.so.debug...done.
done.
Loaded symbols for /lib64/libresolv-2.12.so
Reading symbols from /usr/lib64/libsasl2.so.2.0.23...Reading symbols from /usr/lib/debug/usr/lib64/libsasl2.so.2.0.23.debug...done.
done.
Loaded symbols for /usr/lib64/libsasl2.so.2.0.23
Reading symbols from /lib64/libz.so.1.2.3...Reading symbols from /usr/lib/debug/lib64/libz.so.1.2.3.debug...done.
done.
Loaded symbols for /lib64/libz.so.1.2.3
Reading symbols from /lib64/libfreebl3.so...Reading symbols from /usr/lib/debug/lib64/libfreebl3.so.debug...done.
done.
Loaded symbols for /lib64/libfreebl3.so
Reading symbols from /usr/lib64/ldb/memberof.so...Reading symbols from /usr/lib/debug/usr/lib64/ldb/memberof.so.debug...done.
done.
Loaded symbols for /usr/lib64/ldb/memberof.so
Reading symbols from /usr/lib64/sssd/libsss_ipa.so.1.0.0...Reading symbols from /usr/lib/debug/usr/lib64/sssd/libsss_ipa.so.1.0.0.debug...done.
done.
Loaded symbols for /usr/lib64/sssd/libsss_ipa.so.1.0.0
Reading symbols from /lib64/libkeyutils.so.1.3...Reading symbols from /usr/lib/debug/lib64/libkeyutils.so.1.3.debug...done.
done.
Loaded symbols for /lib64/libkeyutils.so.1.3
Reading symbols from /lib64/libkrb5.so.3.3...Reading symbols from /usr/lib/debug/lib64/libkrb5.so.3.3.debug...done.
done.
Loaded symbols for /lib64/libkrb5.so.3.3
Reading symbols from /lib64/libk5crypto.so.3.1...Reading symbols from /usr/lib/debug/lib64/libk5crypto.so.3.1.debug...done.
done.
Loaded symbols for /lib64/libk5crypto.so.3.1
Reading symbols from /lib64/libcom_err.so.2.1...Reading symbols from /usr/lib/debug/lib64/libcom_err.so.2.1.debug...done.
done.
Loaded symbols for /lib64/libcom_err.so.2.1
Reading symbols from /usr/lib64/libipa_hbac.so.0.0.0...Reading symbols from /usr/lib/debug/usr/lib64/libipa_hbac.so.0.0.0.debug...done.
done.
Loaded symbols for /usr/lib64/libipa_hbac.so.0.0.0
Reading symbols from /usr/lib64/libunistring.so.0.1.2...Reading symbols from /usr/lib/debug/usr/lib64/libunistring.so.0.1.2.debug...done.
done.
Loaded symbols for /usr/lib64/libunistring.so.0.1.2
Reading symbols from /lib64/libkrb5support.so.0.1...Reading symbols from /usr/lib/debug/lib64/libkrb5support.so.0.1.debug...done.
done.
Loaded symbols for /lib64/libkrb5support.so.0.1
Reading symbols from /lib64/libselinux.so.1...Reading symbols from /usr/lib/debug/lib64/libselinux.so.1.debug...done.
done.
Loaded symbols for /lib64/libselinux.so.1
Reading symbols from /lib64/libnss_files-2.12.so...Reading symbols from /usr/lib/debug/lib64/libnss_files-2.12.so.debug...done.
done.
Loaded symbols for /lib64/libnss_files-2.12.so
Reading symbols from /lib64/libnss_sss.so.2...Reading symbols from /usr/lib/debug/lib64/libnss_sss.so.2.debug...done.
done.
Loaded symbols for /lib64/libnss_sss.so.2
Reading symbols from /usr/lib64/sasl2/libplain.so.2.0.23...Reading symbols from /usr/lib/debug/usr/lib64/sasl2/libplain.so.2.0.23.debug...done.
done.
Loaded symbols for /usr/lib64/sasl2/libplain.so.2.0.23
Reading symbols from /usr/lib64/sasl2/libsasldb.so.2.0.23...Reading symbols from /usr/lib/debug/usr/lib64/sasl2/libsasldb.so.2.0.23.debug...done.
done.
Loaded symbols for /usr/lib64/sasl2/libsasldb.so.2.0.23
Reading symbols from /lib64/libdb-4.7.so...Reading symbols from /usr/lib/debug/lib64/libdb-4.7.so.debug...done.
done.
Loaded symbols for /lib64/libdb-4.7.so
Reading symbols from /usr/lib64/sasl2/libdigestmd5.so.2.0.23...Reading symbols from /usr/lib/debug/usr/lib64/sasl2/libdigestmd5.so.2.0.23.debug...done.
done.
Loaded symbols for /usr/lib64/sasl2/libdigestmd5.so.2.0.23
Reading symbols from /usr/lib64/libcrypto.so.1.0.0...Reading symbols from /usr/lib/debug/usr/lib64/libcrypto.so.1.0.0.debug...done.
done.
Loaded symbols for /usr/lib64/libcrypto.so.1.0.0
Reading symbols from /usr/lib64/sasl2/libgssapiv2.so.2.0.23...Reading symbols from /usr/lib/debug/usr/lib64/sasl2/libgssapiv2.so.2.0.23.debug...done.
done.
Loaded symbols for /usr/lib64/sasl2/libgssapiv2.so.2.0.23
Reading symbols from /lib64/libgssapi_krb5.so.2.2...Reading symbols from /usr/lib/debug/lib64/libgssapi_krb5.so.2.2.debug...done.
done.
Loaded symbols for /lib64/libgssapi_krb5.so.2.2
Reading symbols from /usr/lib64/sasl2/libcrammd5.so.2.0.23...Reading symbols from /usr/lib/debug/usr/lib64/sasl2/libcrammd5.so.2.0.23.debug...done.
done.
Loaded symbols for /usr/lib64/sasl2/libcrammd5.so.2.0.23
Reading symbols from /usr/lib64/sasl2/liblogin.so.2.0.23...Reading symbols from /usr/lib/debug/usr/lib64/sasl2/liblogin.so.2.0.23.debug...done.
done.
Loaded symbols for /usr/lib64/sasl2/liblogin.so.2.0.23
Reading symbols from /usr/lib64/sasl2/libanonymous.so.2.0.23...Reading symbols from /usr/lib/debug/usr/lib64/sasl2/libanonymous.so.2.0.23.debug...done.
done.
Loaded symbols for /usr/lib64/sasl2/libanonymous.so.2.0.23
Reading symbols from /usr/lib64/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so...Reading symbols from /usr/lib/debug/usr/lib64/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so.debug...done.
done.
Loaded symbols for /usr/lib64/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so
Reading symbols from /usr/lib64/libsoftokn3.so...Reading symbols from /usr/lib/debug/usr/lib64/libsoftokn3.so.debug...done.
done.
Loaded symbols for /usr/lib64/libsoftokn3.so
Reading symbols from /usr/lib64/libsqlite3.so.0.8.6...Reading symbols from /usr/lib/debug/usr/lib64/libsqlite3.so.0.8.6.debug...done.
done.
Loaded symbols for /usr/lib64/libsqlite3.so.0.8.6
Core was generated by `/usr/libexec/sssd/sssd_be -d 0 --debug-to-files --domain idm.lab.bos.redhat.com'.
Program terminated with signal 11, Segmentation fault.
#0  hbac_eval_service_element (mem_ctx=0x2568880, hbac_ctx=<value optimized out>, rules=0x7fff76250748, request=0x7fff76250740)
    at src/providers/ipa/ipa_hbac_common.c:654
654	    svc->groups = talloc_array(svc, const char *, el->num_values + 1);

Thread 1 (Thread 0x7f1eafb73700 (LWP 14471)):
#0  hbac_eval_service_element (mem_ctx=0x2568880, hbac_ctx=<value optimized out>, rules=0x7fff76250748, request=0x7fff76250740)
    at src/providers/ipa/ipa_hbac_common.c:654
        j = <value optimized out>
        msgs = 0x2566910
        ret = <value optimized out>
        count = 1
        svc_dn = <value optimized out>
        memberof_attrs = {0x7f1ea4e8d1c3 "originalMemberOf", 0x0}
        i = <value optimized out>
        tmp_ctx = 0x25665f0
        svc = <value optimized out>
        el = 0x0
        name = <value optimized out>
#1  hbac_ctx_to_eval_request (mem_ctx=0x2568880, hbac_ctx=<value optimized out>, rules=0x7fff76250748, request=0x7fff76250740)
    at src/providers/ipa/ipa_hbac_common.c:449
        ret = <value optimized out>
        pd = 0x255d190
        tmp_ctx = <value optimized out>
        sysdb = <value optimized out>
        domain = 0x24fcf20
        eval_req = <value optimized out>
        rhost = <value optimized out>
        thost = <value optimized out>
#2  hbac_ctx_to_rules (mem_ctx=0x2568880, hbac_ctx=<value optimized out>, rules=0x7fff76250748, request=0x7fff76250740) at src/providers/ipa/ipa_hbac_common.c:238
        ret = <value optimized out>
        new_rules = 0x2564ed0
        new_request = <value optimized out>
        i = <value optimized out>
        tmp_ctx = 0x2562e00
        __FUNCTION__ = "hbac_ctx_to_rules"
#3  0x00007f1ea4e2b528 in ipa_hbac_evaluate_rules (hbac_ctx=0x2568880) at src/providers/ipa/ipa_access.c:566
        ret = <value optimized out>
        hbac_rules = <value optimized out>
        eval_req = <value optimized out>
        result = <value optimized out>
---Type <return> to continue, or q <return> to quit---
        info = <value optimized out>
        __FUNCTION__ = "ipa_hbac_evaluate_rules"
#4  0x00007f1ea4e2d6bc in hbac_sysdb_save (req=0x0) at src/providers/ipa/ipa_access.c:534
        ret = <value optimized out>
        in_transaction = true
        hbac_ctx = 0x2568880
        domain = <value optimized out>
        sysdb = <value optimized out>
        base_dn = <value optimized out>
        be_ctx = <value optimized out>
        access_ctx = 0x251e930
        tmp_ctx = <value optimized out>
        __FUNCTION__ = "hbac_sysdb_save"
#5  0x00007f1ea4e32657 in ipa_hbac_rule_info_done (subreq=<value optimized out>) at src/providers/ipa/ipa_hbac_rules.c:213
        ret = 0
        req = 0x2564710
        state = 0x2528e30
        __FUNCTION__ = "ipa_hbac_rule_info_done"
#6  0x00007f1ea4e48666 in sdap_get_generic_done (op=<value optimized out>, reply=<value optimized out>, error=<value optimized out>, pvt=<value optimized out>)
    at src/providers/ldap/sdap_async.c:1031
        req = 0x2529860
        state = 0x2535b60
        attrs = <value optimized out>
        errmsg = 0x0
        result = 0
        ret = <value optimized out>
        lret = 0
        total_count = 0
        cookie = {bv_len = 0, bv_val = 0x2568600 "p\265S\002"}
        returned_controls = 0x2563400
        page_control = <value optimized out>
        __FUNCTION__ = "sdap_get_generic_done"
#7  0x00007f1ea4e4a215 in sdap_process_message (ev=<value optimized out>, pvt=<value optimized out>) at src/providers/ldap/sdap_async.c:307
        msgtype = <value optimized out>
        ret = 0
        reply = 0x2563010
        op = 0x2533f00
        msgid = 12
#8  sdap_process_result (ev=<value optimized out>, pvt=<value optimized out>) at src/providers/ldap/sdap_async.c:207
        sh = <value optimized out>
        no_timeout = {tv_sec = 0, tv_usec = 0}
        te = <value optimized out>
---Type <return> to continue, or q <return> to quit---
        msg = 0x2560bf0
        ret = <value optimized out>
        __FUNCTION__ = "sdap_process_result"
#9  0x00007f1eaf55b4e5 in tevent_common_loop_timer_delay (ev=0x24f8490) at tevent_timed.c:254
        current_time = {tv_sec = 0, tv_usec = 0}
        te = 0x2563be0
#10 0x00007f1eaf55d31b in std_event_loop_once (ev=<value optimized out>, location=<value optimized out>) at tevent_standard.c:537
        std_ev = 0x24f8550
        tval = {tv_sec = 0, tv_usec = 0}
#11 0x00007f1eaf55a6d0 in _tevent_loop_once (ev=0x24f8490, location=0x443cd5 "src/util/server.c:526") at tevent.c:490
        ret = <value optimized out>
        nesting_stack_ptr = 0x0
#12 0x00007f1eaf55a73b in tevent_common_loop_wait (ev=0x24f8490, location=0x443cd5 "src/util/server.c:526") at tevent.c:591
        ret = <value optimized out>
#13 0x00000000004358b1 in server_loop (main_ctx=0x24f9600) at src/util/server.c:526
No locals.
#14 0x000000000040eeab in main (argc=6, argv=<value optimized out>) at src/providers/data_provider_be.c:1333
        opt = <value optimized out>
        pc = <value optimized out>
        be_domain = 0x24f7490 "idm.lab.bos.redhat.com"
        srv_name = <value optimized out>
        conf_entry = <value optimized out>
        main_ctx = 0x24f9600
        ret = 0
        long_options = {{longName = 0x0, shortName = 0 '\000', argInfo = 4, arg = 0x64a440, val = 0, descrip = 0x43a8d2 "Help options:", argDescrip = 0x0}, {
            longName = 0x43a8e0 "debug-level", shortName = 100 'd', argInfo = 2, arg = 0x64a520, val = 0, descrip = 0x43a8b1 "Debug level", argDescrip = 0x0}, {
            longName = 0x43a8ec "debug-to-files", shortName = 102 'f', argInfo = 0, arg = 0x64a524, val = 0, 
            descrip = 0x43b548 "Send the debug output to files instead of stderr", argDescrip = 0x0}, {longName = 0x43a8fb "debug-timestamps", 
            shortName = 0 '\000', argInfo = 2, arg = 0x64a400, val = 0, descrip = 0x43a8bd "Add debug timestamps", argDescrip = 0x0}, {
            longName = 0x43bec0 "domain", shortName = 0 '\000', argInfo = 1, arg = 0x7fff76250c58, val = 0, 
            descrip = 0x43b580 "Domain of the information provider (mandatory)", argDescrip = 0x0}, {longName = 0x0, shortName = 0 '\000', argInfo = 0, arg = 0x0, 
            val = 0, descrip = 0x0, argDescrip = 0x0}}
        __FUNCTION__ = "main"
[root@qe-blade-04 ~]#

Comment 4 Gowrishankar Rajaiyan 2011-10-24 19:10:52 UTC

Setup of IPA Server:
ipa user-find
-------------------------------
Number of entries returned 1283
-------------------------------

ipa host-find
-------------------------------
Number of entries returned 1281
-------------------------------

ipa hostgroup-find
-------------------------------
Number of entries returned 1278
-------------------------------

ipa hbacrule-find
-------------------------------
Number of entries returned 1280
-------------------------------

[root@bumblebee ~]# ipa hbacrule-find shanks
-------------------
1 HBAC rule matched
-------------------
  Rule name: shanks
  Enabled: TRUE
  Users: shanks
  Hosts: sideswipe.lab.eng.pnq.redhat.com
  Source Hosts: sideswipe.lab.eng.pnq.redhat.com
  Services: sshd
----------------------------
Number of entries returned 1
----------------------------

Client:
[root@sideswipe ~]# time ssh -l shanks $HOSTNAME
shanks.eng.pnq.redhat.com's password: 
Last login: Tue Oct 25 06:41:21 2011 from sideswipe.lab.eng.pnq.redhat.com
Could not chdir to home directory /home/shanks: No such file or directory
-sh-4.1$ logout
Connection to sideswipe.lab.eng.pnq.redhat.com closed.

real	0m11.992s
user	0m0.004s
sys	0m0.024s
[root@sideswipe ~]# rm -fr /var/lib/sss/db/cache_lab.eng.pnq.redhat.com.ldb 
[root@sideswipe ~]# service sssd restart
Stopping sssd:                                             [  OK  ]
Starting sssd:                                             [  OK  ]
[root@sideswipe ~]# time ssh -l shanks $HOSTNAME
shanks.eng.pnq.redhat.com's password: 
Last login: Tue Oct 25 06:42:57 2011 from sideswipe.lab.eng.pnq.redhat.com
Could not chdir to home directory /home/shanks: No such file or directory
-sh-4.1$ logout
Connection to sideswipe.lab.eng.pnq.redhat.com closed.

real	0m13.183s
user	0m0.006s
sys	0m0.023s
[root@sideswipe ~]# 

Verified. 
ipa-server-2.1.3-2.el6.x86_64
sssd-1.5.1-60.el6.x86_64

Comment 5 Jakub Hrozek 2011-10-27 14:32:04 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Do not document

Comment 6 errata-xmlrpc 2011-12-06 16:40:59 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1529.html