Procedure

1. Open the /etc/sssd/sssd.conf configuration file in a text editor.

2. Add the following options to the [domain] section for your Active Directory domain. If you do not already have a domain section for your AD domain, create one.

   [domain/ad.example.com]
   ignore_group_members = true
   subdomain_inherit = ignore_group_members
   ...

3. Save and close the /etc/sssd/sssd.conf file on the server.

4. Restart the SSSD service to load the configuration changes.

   [root@client ~]# systemctl restart sssd

Procedure

1. Determine the number of seconds a single un-cached login takes.

   1. Clear the SSSD cache on the IdM client client.example.com.

      [root@client ~]# sss_cache -E

   2. Measure how long it takes to log in as an AD user with the time command. In this example, from the IdM client client.example.com, log into the same host as the user ad-user from the ad.example.com AD domain.

      [root@client ~]# time ssh ad-user@ad.example.com@client.example.com

   3. Type in the password as soon as possible.

      Password:
      Last login: Sat Jan 23 06:29:54 2021 from 10.0.2.15
      [ad-user@ad.example.com@client ~]$

   4. Log out as soon as possible to display elapsed time. In this example, a single un-cached login takes about 9 seconds.

      [ad-user@ad.example.com@client /]$ exit
      logout
      Connection to client.example.com closed.
      
      real 0m8.755s
      user    0m0.017s
      sys     0m0.013s

2. Open the /etc/sssd/sssd.conf configuration file in a text editor.

3. Add the following options to the [domain] section for your Active Directory domain. Set the pam_id_timeout and krb5_auth_timeout options to the number of seconds an un-cached login takes. If you do not already have a domain section for your AD domain, create one.

   [domain/ad.example.com]
   pam_id_timeout = 9
   krb5_auth_timeout = 9
   ldap_deref_threshold = 0
   ...

4. Save and close the /etc/sssd/sssd.conf file on the server.

5. Restart the SSSD service to load the configuration changes.

   [root@client ~]# systemctl restart sssd

Procedure

1. Create a tmpfs temporary filesystem by adding the following entry to /etc/fstab as a single line:

   tmpfs /var/lib/sss/db/ tmpfs size=300M,mode=0700,rootcontext=system_u:object_r:sssd_var_lib_t:s0 0 0

   This example creates a 300MB cache. Tune the size parameter according to your IdM and AD directory size, estimating 100 MBs per 10,000 LDAP entries.

2. Mount the new SSSD cache directory.

   [root@host ~]# mount /var/lib/sss/db/

3. Restart SSSD to reflect this configuration change.

   [root@host ~]# systemctl restart sssd