Re: [Freeipa-users] Can too many group memberships for an AD user cause SSSD or IPA problems?

2017-02-04 Thread Jakub Hrozek
On Fri, Feb 03, 2017 at 09:54:01AM -0500, Chris Dagdigian wrote: > > I've got a case where "id @AD-DOMAIN" hangs forever after partially > resolving and I think it may because they are in way too many AD groups? I don't think id should hang totally (at the very least, there is a NSS timeout that

[Freeipa-users] Can too many group memberships for an AD user cause SSSD or IPA problems?

2017-02-03 Thread Chris Dagdigian
I've got a case where "id @AD-DOMAIN" hangs forever after partially resolving and I think it may because they are in way too many AD groups? The 'id' command resolve the user but hangs before completing. There is a large amount of group data returned from the AD forest for this user and the