[ovirt-users] Re: AAA question...takes long time to log in
On 07/27/2018 01:59 AM, sipandbite(a)hotmail.com wrote:
I work at a company with a massive AD infrastructure. Is there any
way to specify a specific OU to search through instead of just providing a top level DN?
We use sssd for all our authing needs on our linux machines and would like to do something
like below:
ldap_user_search_base = OU=Employees,OU=blah users,DC=blah,DC=com
enumerate = false
When I connect on cli it looks like Ovirt is reaching out and grabbing a ton of info it
doesn't really need. It takes on average 40 second to allow me to log in on CLI or UI.
This is not an AD issue as we use AD on everything in our labs and have no issues with
speed.
I applied these changes and it didn't speed anything up.
https://ovirt.org/develop/release-management/features/infra/aaa_faq/
I can see from a tcpdump that I am in fact hitting my local AD servers and not going
across the world to get an answer.
Do you use include <ad.properties> or include <ad-recursive.properties>?
ad.properties is using LDAP_MATCHING_RULE_IN_CHAIN which means less
network requests to AD servers, but higher load on less AD servers,
to fetch users/groups information.
ad-recursive.properties is using more request on more AD servers to get
full users/groups information, but has higher load on network. So it's
bad if you have high latency on network, but good in case you have slow
AD servers, but good latency network.
Try both and you can see which will show better performance for you.
In order to modify baseDN of search user request, you may add to your
profile.properties file:
search.ad-query-principals.search-request.baseDN =
OU=Employees,OU=blah users,${seq:_ad_baseDN}
>
> Thanks!
> _______________________________________________
> Users mailing list -- users(a)ovirt.org
> To unsubscribe send an email to users-leave(a)ovirt.org
> Privacy Statement: https://www.ovirt.org/site/privacy-policy/
> oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/
> List Archives:
https://lists.ovirt.org/archives/list/users@ovirt.org/message/WOHX5FFV5LF...
>