On Tue, Apr 12, 2016 at 09:45:17AM +0200, Marcin Trendota wrote: > W dniu 11.04.2016 o 20:07, Scott Robbins pisze: > > >>> Any ideas? > >> DNS? > > Is LDAP listed in the /etc/nsswitch.conf? > > In nsswitch.conf i have: > passwd: files sss > shadow: files sss > group: files sss > > DNS works fine. I think that sssd communicates with LDAP server with > every authentication - i have tons of following entries in log: > > http://pastebin.com/rZVjk0gW > > And it repeats for same user over and over again. Is this correct behavior? RedHat never really mastered LDAP, unfortunately. I have a by now ancient article, that mentions it. What I found back then is that if it EVER uses LDAP for anything, upon boot, it will look for an LDAP server. It doesn't even have to be one that the workstation uses--it just wants to know there's one on the network. In other words, I have server1 which workstation1 can use for authentication, and server2, which does, say, address book duty. The workstation also does authenticate for some things against the server1. If server1 is off, although there's a local account on workstation, it will look and hang for awhile, till it gives up and finally logs on the local account. However, if server2 is on--that is, as long as there's an LDAP server that it can see, even though that server isn't used for authentication, workstation1 will, IIRC, try it, see it can't authenticate, and then use local authentication. Again, this is something that happened a long time ago and I haven't tried in a long while. However, that's why I asked if LDAP was involved, because it might be the issue. -- Scott Robbins PGP keyID EB3467D6 ( 1B48 077D 66F6 9DB0 FDC2 A409 FA54 EB34 67D6 ) gpg --keyserver pgp.mit.edu --recv-keys EB3467D6