Description of problem:
High login times are encountered for user accounts that are fetched from AD
using the trust between IPA and AD realms, when the AD realm has lots (e.g.
thousands) of user accounts.
Version-Release number of selected component (if applicable):
ipa-server 4.6.6
How reproducible:
Always
Steps to Reproduce:
1. Install and configure IPA server, use default configuration
2. Install and configure IPA client, use default configuration
3. Have a Microsoft Active Directory instance with a high amount (e.g.
thousands) of users
3. Create a trust between IPA and AD and set up AD users to be able to login
through the trust
4. Try to login with an AD user account
Actual results:
Login over ssh takes 5-10 seconds
Expected results:
Login should not take this long, expected login time is about one second
Additional info:
The issue is caused by ipaExternalMember entry being unindexed and can be
mitigated on the IPA server-side with the following:
Create a file: 90-index-ipaExternalMember.update
-------------------------------------------------------------------------------
-------------
dn: cn=ipaExternalMember,cn=index,cn=userRoot,cn=ldbm
database,cn=plugins,cn=config
default: cn: ipaExternalMember
default: objectClass: top
default: objectClass: nsIndex
default: nsSystemIndex: false
default: nsIndexType: eq
-------------------------------------------------------------------------------
-------------
Apply it by running the following as root on all of IPA servers:
  # ipa-ldap-updater ./90-index-ipaExternalMember.update
Since the version 4.6.5 of IPA there's an auto-indexing feature. So after this
schema-update is put in place, IPA automatically creates a task for itself to
index ipaExternalMember entries.
/var/log/ipaupgrade.log can be followed to verify the task has started:
  <timestamp> DEBUG Creating task
cn=indextask_<taskid>,cn=index,cn=tasks,cn=config to index attributes:
ipaExternalMember
This issue has been fixed in upstream with: https://github.com/freeipa/freeipa/
commit/9f0ec27e9f13ed40b8e58162d99bf9b0e8b4afd5