Description of problem:
Our RHEL7.2 workstations are configured to use LDAP for account information.  We provide workstations in computing labs for over ten thousand students.  We have GDM configured to not show a user list, yet when GDM starts, or when a user tries to log in, accounts-daemon asks sssd to look up information for every user who has logged into the system since the 'wtmp' file has been rotated (which is every month, by default).  This might be OK if the passwd information was local, but we have have systems that get a wide range of users and have caused enough traffic that our LDAP admins have complained.

I also see accounts-daemon performing these queries while the user is logged in, I believe when making changes to their gnome session properties.

I'm seeing the same behavior for lightdm (from EPEL) as well as SSH logins.

The only solution I can think of is to rotate the wtmp files daily.

Version-Release number of selected component (if applicable):
accountsservice-0.6.35-9.el7.x86_64

How reproducible:
Always.

Steps to Reproduce:
1. Set up SSSD to talk to an LDAP system
2. Run '/usr/libexec/accounts-daemon --debug' so you can watch the queries
3. Log into system

Actual results:
You will see output that looks like this:


(accounts-daemon:39483): DEBUG: user <USERNAME> has 1 groups
(accounts-daemon:39483): DEBUG: loaded user: <USERNAME>


for every <USERNAME> in the output of 'last'.  At least twice for every login, once when the login screen comes up, and once when the user enters their username and then switches to the password field.

Expected results:
accounts-daemon shouldn't be querying every logged-in user every time.

Additional info: