<div dir="ltr"><div>+Ovirt users mailing list - might find this interesting. Quick background: IPA server with cross-forest trust to Windows domain. Authenticating to Linux clients with domain kerberos credentials.</div><div>
<br></div><div>I'm hosting CentOS 6.5 as an ovirt guest, and have narrowed this ipa client slow login issue down to a backend storage cause. If I enable async writes to NFS the CentOS guest performs as my workstations virtualbox guests (Ubuntu 13.10/Fedora 20) do on login (quick logins).</div>
<div><br></div><div>The client we are investigating is a CentOS 6.5 machine. I've also done the same test on a RHEL 6.5 machine with the same results. I've increased the logging level, log attached. I don't see the DC in the logs anywhere.<br>
</div><div><br></div><div>I guess from an IPA perspective there is not much to be done, but I wanted to make sure this thread came to some conclusion for future readers. I suppose the only thing to question, is why ipa authentication would have any reliance on disk read/write speed to this extent? Perhaps we are caching something to disk that should be cached in memory?</div>
<div><br>
</div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><span style="font-family:arial,sans-serif;font-size:16px"><strong>Steve Dainard </strong></span><span style="font-size:12px"></span><br>
<span style="font-family:arial,sans-serif;font-size:12px">IT Infrastructure Manager<br>
<a href="http://miovision.com/" target="_blank">Miovision</a> | <em>Rethink Traffic</em><br><br>
<strong style="font-family:arial,sans-serif;font-size:13px;color:#999999"><a href="http://miovision.com/blog" target="_blank">Blog</a> | </strong><font color="#999999" style="font-family:arial,sans-serif;font-size:13px"><strong><a href="https://www.linkedin.com/company/miovision-technologies" target="_blank">LinkedIn</a> | <a href="https://twitter.com/miovision" target="_blank">Twitter</a> | <a href="https://www.facebook.com/miovision" target="_blank">Facebook</a></strong></font> </span>
<hr style="font-family:arial,sans-serif;font-size:13px;color:#333333;clear:both">
<div style="color:#999999;font-family:arial,sans-serif;font-size:13px;padding-top:5px">
<span style="font-family:arial,sans-serif;font-size:12px">Miovision Technologies Inc. | 148 Manitou Drive, Suite 101, Kitchener, ON, Canada | N2C 1L3</span><br>
<span style="font-family:arial,sans-serif;font-size:12px">This e-mail may contain information that is privileged or confidential. If you are not the intended recipient, please delete the e-mail and any attachments and notify us immediately.</span></div>
</div></div>
<br><br><div class="gmail_quote">On Wed, Feb 12, 2014 at 7:02 AM, Sumit Bose <span dir="ltr"><<a href="mailto:sbose@redhat.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=sbose@redhat.com&cc=&bcc=&su=&body=','_blank');return false;">sbose@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Mon, Feb 10, 2014 at 02:08:22PM -0500, Steve Dainard wrote:<br>
> Sure:<br>
><br>
<br>
...<br>
<div class=""><br>
> (0x0400): Attempting kinit for realm [MIOVISION.CORP]<br>
> (Mon Feb 10 10:14:58 2014) [[sssd[krb5_child[9879]]]] [validate_tgt]<br>
> (0x0400): TGT verified using key for<br>
> [host/snapshot-test.miolinux.corp@MIOLINUX.CORP].<br>
> (Mon Feb 10 10:15:06 2014) [[sssd[krb5_child[9879]]]] [become_user]<br>
> (0x0200): Trying to become user [799001323][799001323].<br>
<br>
</div>...<br>
<div class=""><br>
> (0x0400): Attempting kinit for realm [MIOVISION.CORP]<br>
> (Mon Feb 10 10:16:35 2014) [[sssd[krb5_child[9929]]]] [validate_tgt]<br>
> (0x0400): TGT verified using key for<br>
> [host/snapshot-test.miolinux.corp@MIOLINUX.CORP].<br>
> (Mon Feb 10 10:16:40 2014) [[sssd[krb5_child[9929]]]] [become_user]<br>
> (0x0200): Trying to become user [799001323][799001323].<br>
<br>
</div>...<br>
<div class=""><br>
> (0x0400): Attempting kinit for realm [MIOVISION.CORP]<br>
> (Mon Feb 10 10:16:57 2014) [[sssd[krb5_child[9960]]]] [validate_tgt]<br>
> (0x0400): TGT verified using key for<br>
> [host/snapshot-test.miolinux.corp@MIOLINUX.CORP].<br>
> (Mon Feb 10 10:17:01 2014) [[sssd[krb5_child[9960]]]] [become_user]<br>
> (0x0200): Trying to become user [799001323][799001323].<br>
<br>
</div>...<br>
<div class=""><br>
> (0x0400): Attempting kinit for realm [MIOVISION.CORP]<br>
> (Mon Feb 10 10:17:30 2014) [[sssd[krb5_child[10018]]]] [validate_tgt]<br>
> (0x0400): TGT verified using key for<br>
> [host/snapshot-test.miolinux.corp@MIOLINUX.CORP].<br>
> (Mon Feb 10 10:17:34 2014) [[sssd[krb5_child[10018]]]] [become_user]<br>
> (0x0200): Trying to become user [799001323][799001323].<br>
<br>
</div>as you can see the time is spend to validate the ticket. For a user from<br>
a trusted domain this includes a request for a cross-realm TGT to a AD<br>
server and then a request to an IPA KDC for a service ticket for the<br>
local host. With debug_level 9 and higher the libkrb5 tracing is<br>
switched on which would in more detail show where the time is lost. It<br>
will also show which AD server is contacted.<br>
<br>
You mentioned in your other mail that with a different client the logins<br>
are faster. Are the two clients in the same network segment? Or is there<br>
a chance that the other client is "nearer" to the AD server?<br>
<br>
bye,<br>
Sumit<br>
</blockquote></div><br></div></div>