freeipa

#7217 Significantly reduce the KDC LDAP driver search timeout
Closed: fixed Opened by rcritten.

Closed: fixed
Reopen Issue

The KDB search timeout is currently hardcoded to 5 minutes which is way too long.

We discovered this when investigating some test failure related to kinit failures.

While this value has been 300 seconds since 2011 waiting 5 minutes on a search isn't all that helpful given other operations would have blow up a this point anyway. A 1 minute timeout is likely sufficient.

+1 from me.

It's worth noting for future debugging purposes that the lookup is blocking to the entire KDC - if we ever hit this timeout, it means that the KDC has been wholly unresponsive for the entire interval.

Simo pointed out that 1 min is the AS REQ timeout clients use so perhaps a 30s timeout may even be appropriate.

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7 backlog

Metadata Update from @rcritten:
- Issue priority set to: important

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7 (was: FreeIPA 4.7 backlog)

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)

FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone

Metadata Update from @abbra:
- Issue assigned to abbra

PR for master branch: https://github.com/freeipa/freeipa/pull/2575

Metadata Update from @abbra:
- Issue set to the milestone: FreeIPA 4.6 (was: FreeIPA 4.7.1)

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.6.5 (was: FreeIPA 4.6)

master:

  • 122f968ceebbe80a47eca842a98bb39876264535 ipa-kdb: reduce LDAP operations timeout to 30 seconds

ipa-4-6:

  • e0921b41a213220855c67feb4d2a267d54bb2694 ipa-kdb: reduce LDAP operations timeout to 30 seconds

ipa-4-7:

  • 86d4b1c0163f84c53e07b5dfc40ad131db2f4ba2 ipa-kdb: reduce LDAP operations timeout to 30 seconds

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.