Puppet users - Aug 2014 - puppet slow when ensuring user with groups in combination with winbind auth

Hi,

I am using winbind with "winbind enum groups = yes" on some of our
servers.
When ensuring a user that is local (and also in AD, so it has a lot of 
groups) the puppet run takes ages. Winbind process is taking a lot of cpu 
and when I strace it AD groups are passing by.

This is the manifest:

 # ensure user and group  
    user { user:
      ensure     => 'present',
      groups     => 'logongroup',
      uid        => '900',
      require    => Group[$user],
      managehome => true,
    }
    group { user:
      ensure => 'present',
      gid    => '900',
    }

# id user
uid=900(user) gid=900(user) 
groups=900(user),400(logongroup),16777729(domain users) .............

What is puppet doing? I am presuming it is checking if this user is a 
member of the logongroup. 

Can you make puppet not performing these group checks preforming in AD?
My nsswitch.conf tells it to first look in local files. 

passwd:     files winbind
shadow:     files winbind
group:      files winbind

So why is it still performing these tasks when the logongroup is already 
present in local files?

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/6f933611-570d-45f6-b26b-00c0737d7930%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.