On 04/12/2016 09:51 AM, James Hogarth wrote: > To the OP enumerate is always painful, I'd remove that for a start. This was my experience too, for what it's worth. When I first set up a new system pointed at LDAP it was absurdly slow to authenticate. Setting Enumerate to False in /etc/sssd/sssd.conf made all the difference.