[CentOS] SSSD with 389DS

Hi!

We are setting up an environment with two 389DS configured as master-consumer. The DIT holds about 70.000 user records. A couple of other machines running SSSD will be using the 389DS setup for all user info lookups that would normally go to passwd/shadow. There are also other applications that will be querying the 389DS for various other user data. All servers are running CentOS6.

In total I would estimate that SSSD would be handling about 400 queries per second.

How should I configure SSSD to get the most out of it? Cache refreshes, (negative) timeouts, expirations, enumerations?

Regards, Mitja