Two questions:

  1. After I stop the sssd service and delete the cache is it normal for it to take a a minute or two before being able to login again?

  2. If I have this value set to 7 days in the /etc/sssd/sssd.conf file "account_cache_expiration = 7" will it take a minute or two to login again if I haven't logged in for more than 7 days?


2 Answers 2


i think i got it now... needed to add this

ignore_group_members = true


No, it's not normal — it should take nowhere near a minute or two to get a response from the directory server. An extra second or two, sure, but not a minute or two.

I'd guess the most likely reason for adding an extra minute is SSSD is trying to contact a directory server that is down or no longer exists. If you're using DNS SRV records, make sure you don't have any old ones (pointing to decommissioned servers) around.

If you increase the log level in SSSD, it should log the particular timeouts its experiencing to help you find the responsible server.

And yes, when the cache expires, SSSD is going to have to query the directory server again — which if that takes minutes is going to be painful.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .