This bug was initially created as a copy of Bug #1998459 I am copying this bug because: to track fix for RHEL8 This bug was initially created as a copy of Bug #1984591 I am copying this bug because: to track fix for RHEL9 Description of problem: - After sssd update to 1.16.5-10.el7_9.8.x86_64 the customer is facing slow connection/authentication. BEFORE UPGRADE: [root@HOST01 ~]# date; time id sssd Tue Jun 29 13:41:22 EDT 2021 uid=217(sssd) gid=987(sssd) groups=987(sssd) real 1m30.030s user 0m0.004s sys 0m0.004s AFTER DOWNGRADE [root@HOST01 ~]# date; time id sssd Tue Jun 29 13:47:17 EDT 2021 uid=217(sssd) gid=987(sssd) groups=987(sssd) real 0m7.300s user 0m0.003s sys 0m0.004s ======================================================================= Version-Release number of selected component (if applicable): BEFORE: 1.16.5-10.el7_9.7.x86_64 AFTER UPGRADE: 1.16.5-10.el7_9.8.x86_64 ======================================================================= How reproducible: Upgrading sssd Steps to Reproduce: 1. Upgrading sssd 2. Authentication and fetch users/groups are slowing. 3. Restarting sssd and clear cache does NOT help. ====================================================================== Actual results: Slow authentication and fetch users. Expected results: Normal behaviour as using previous version: ===================================================================== Additional info: A - We figure out a workaround adding the parameter "ad_enabled_domains " on sssd.conf, however the customer said that it worked for more than 3 years without add the below line: ad_enabled_domains = domain1.com, domain2.example.com, domain3.example.com, domain4.example.com. B- After add "ad_enabled_domains", the sssd is working properly again with the new sssd release. C- We also noticed the below difference after the update: [root@zzzkctst011 ~]# sssctl domain-list domain1.com domain2.example.com domain3.example.com domain4.example.com. [root@HOST01 ~]# rpm -q sssd sssd-1.16.5-10.el7_9.7.x86_64 **NOTE: JUST 4 DOMAINS ARE FETCHED. But after updating it to version 1.16.5-10.0.1.el7_9.8 we are seeing this domains. [root@HOST01 ~]# sssctl domain-list domain1.com domain2.example.com domain3.example.com domain4.example.com. DOMAIN.NET DOMAIN.DMZ DOMAIN5.COM DOMAIN.LOCAL **NOTE: MANY MORE DOMAINS ARE FETCHED SOME OF THEM INATIVES. [root@HOST01 ~]# rpm -q sssd sssd-1.16.5-10.el7_9.8.x86_64 D- I suspect the fixed #4980 is affecting this part: https://sssd.io/release-notes/sssd-1.16.5.html
Upstream PR: https://github.com/SSSD/sssd/pull/5850
Pushed PR: https://github.com/SSSD/sssd/pull/5850 * `master` * 4c48c4a7792961cf8a228c76975ac370d32904e1 - ad: filter trusted domains * `sssd-1-16` * 87aaf96ab7bd39698c41625d56602ca3de943b87 - ad: filter trusted domains
Verified tested against sssd-2.6.1-1.el8.x86_64 2021-12-03 18:36:26,174 - sssd.testlib.common.qe_class.QeHost.hostname1.ParamikoTransport - INFO - RUN sssctl domain-list 2021-12-03 18:36:26,175 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - RUN sssctl domain-list 2021-12-03 18:36:26,410 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - implicit_files 2021-12-03 18:36:26,410 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - domain.com 2021-12-03 18:36:26,410 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - child.domain.com 2021-12-03 18:36:26,411 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - child1.domain.com 2021-12-03 18:36:26,411 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - tdomain.com 2021-12-03 18:36:26,412 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - Exit code: 0 implicit_files domain.com child.domain.com child1.domain.com tdomain.com PASSED
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (sssd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:2070