> On Wed, Mar 06, 2019 at 11:24:20PM -0000, Charles Ulrich via FreeIPA-users > wrote: > > In the log snippet the client runs into a timeout, the IPA server didn't > send a reply for 6s. Since you say that you can authenticate in general > on the client I guess this might only a temporary error because e.g. the > server had to refresh its own cache. But you can try to increase > ldap_search_timeout in sssd.conf, see man sssd-ldap for details.
Thanks for the suggestions. I set ldap_search_timeout to 60 and the ssh_authorized_keys command still times out, although it took a bit longer than before (about 20 seconds now). I added ldap_network_timeout = 60 and ldap_opt_timeout = 60 with no change. I made sure to restart sssd after each change. Is there any way to troubleshoot exactly what sss_ssh_authorizedkeys is doing? I don't see a debug or verbose flag in the documentation. I assume it's doing an LDAP lookup, can I replicate that somehow with ldapsearch? > In case you are using 'full_name_format = %1$s' in sssd.conf on the IPA > servers as well please remove it, this option is not supported on IPA > server. I checked to be sure that this is only defined on the client. Thanks, Charles _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
