groupadd takes long time with sssd running

Issue

• Adding system groups (with -r option) on an SSSD clients several minutes when AD trust is configured in the IdM.

For example:

[root@ipa02 ~]# time groupadd -r test4
real    1m52.832s
user    0m0.017s
sys 0m0.009s

# without sssd running:
[root@ipa02 ~]# time groupadd -r test5

real    0m0.057s
user    0m0.004s
sys 0m0.015s

• RHBA-2014:0005-3 is applied, which sounds like it was supposed to fix this when the subdomain provider was configured. However, testing with the subdomain provider explicitly disabled (subdomain_provider = none) still didn't resolve it.

To recreate, setup an IPA/AD trust and register the a client to the IPA domain. Then "groupadd -r test" and wait forever for it to timeout.