sssd-users August 2014

sssd-users@lists.fedorahosted.org

27 participants
36 discussions

sssd auth issue on centos 5.10
by Daniel Jung 22 Aug '14

22 Aug '14

Hi, sssd shows the following error when a user tries to log on using password. enumerate is false. Using 1.5.1.70 Any idea why this is happening? Thanks (Mon Aug 11 19:47:39 2014) [sssd] [mt_svc_exit_handler] (2): Child [LDAP] terminated with signal [11] (Mon Aug 11 19:47:39 2014) [sssd] [sbus_dispatch] (3): Connection is not open for dispatching. (Mon Aug 11 19:47:39 2014) [sssd] [mt_svc_restart] (6): Scheduling service LDAP for restart 1 (Mon Aug 11 19:47:39 2014) [sssd] [start_service] (4): Queueing service LDAP for startup (Mon Aug 11 19:47:39 2014) [sssd] [sbus_server_init_new_connection] (5): Entering. (Mon Aug 11 19:47:39 2014) [sssd] [sbus_server_init_new_connection] (5): Adding connection 0x129cea40. (Mon Aug 11 19:47:39 2014) [sssd] [sbus_init_connection] (5): Adding connection 129CEA40 (Mon Aug 11 19:47:39 2014) [sssd] [sbus_server_init_new_connection] (5): Got a connection (Mon Aug 11 19:47:39 2014) [sssd] [monitor_service_init] (3): Initializing D-BUS Service (Mon Aug 11 19:47:39 2014) [sssd] [client_registration] (4): Received ID registration: (%BE_LDAP,1) (Mon Aug 11 19:47:39 2014) [sssd] [mark_service_as_started] (5): Marking LDAP as started.

3 22

Startup segfault loop of domain_be on Ubuntu 14.04
by Chris Hartman 22 Aug '14

22 Aug '14

Hi guys, Ubuntu 14.04 x86_64 SSSD 1.11.5 Active Directory backend I've been experiencing this problem for a few weeks with no luck in troubleshooting it. During boot, the sssd_be process will continually spawn and crash due to a segfault. When it gets stuck in this loop, domain account login is almost impossible (local accounts still work). I've attached sanitized logs and my sssd.conf file. Please have a look and let me know what you think. Thanks! -Chris

4 17

using ldap -> sssd -> AD (sssd as a proxy)
by Gerardo Padierna 22 Aug '14

22 Aug '14

Hi, I'd like to know if it somehow possible to use sssd as a proxy authenticator, by which I mean the following: · I want to authenticate users defined on a windows AD 2003 server on a Solaris box (sssd is not available) · I'm already using sssd on RHEL boxes -> I'd like to maintain the same UID/GID mapping on the Solarix boxes as those already used on the RHEL machines · I was wondering if there's a conf (or a hack) that makes it possible to authenticate an AD user on a box (which can't run sssd) the following way: Soraris box -> asks ldap server -> asks sssd (on same box or not) -> asks AD Since sssd is a client, I can't figure out how to do that, but maybe there's a way (that's why I was thinking that maybe, by combining an ldap server with sssd, they could act together as an authentication provider). Again: The reason why not using directly just one ldap client on the Solaris boxes is to maintain the same UID/GIDs already defined in other sssd-based hosts. Thanks a lot for any suggestions on this. -- *Gerardo Padierna Nanclares* <mailto:asl.gerardo@gmail.com>

2 2

id, ACLs, and remote groups
by Peter Kirby 21 Aug '14

21 Aug '14

I'm running CentOS 7, fully updated with SSSD version 1.11.2. I used realm to setup SSSD and everything seems to be working fine for authentication. I'm even able to filter access based on an ldap group. My id and access providers are both set to ad. When I try to run: id username, all I get is the "domain users" group listed as the primary group. However, if I run something like: getent group test-group, and then again run id on a user in that group, test-group now shows up in the list along with domain users. While I don't particularly care about the output from id, I'm seeing the same behavior when trying to use ACLs. The scenario is the same as above. Before getent group test-group, the users do not have access via ACL to files. As soon as I run getent, everything starts working as it should. I have tried enumerate = true in sssd.conf and confirmed sss is in nsswitch.conf where it should be, but I cannot seem to make remote groups work. I suspect I'm missing something very small, but I've been searching manuals, google, and the logs for days and I haven't found any solution yet. I would appreciate any suggestions anyone might have. Thanks, Peter -- Peter Kirby System and Database Administrator @ Harding University

4 8

sssd with ctdb
by steve 20 Aug '14

20 Aug '14

Hi Can we use sssd instead of winbind in a ctdb cluster joined to AD in the same way it works on a non clustered file server? Cheers, Steve

3 4

krb5_child can't create ccache with error 13 [Permission Denied]
by Chris Malton 20 Aug '14

20 Aug '14

Hi guys, I'm fairly sure I'm missing something here, but I can't see why. For some reason, I get this in the logs: (Wed Aug 20 07:51:33 2014) [[sssd[krb5_child[3650]]]] [sss_get_ccache_name_for_principal] (0x4000): Location: [FILE:/tmp/krb5cc_1332601725_XXXXXX] (Wed Aug 20 07:51:33 2014) [[sssd[krb5_child[3650]]]] [sss_get_ccache_name_for_principal] (0x2000): krb5_cc_cache_match failed: [-1765328243][Can't find client principal cmalton_it(a)KEGS.LOCAL in cache collection] (Wed Aug 20 07:51:33 2014) [[sssd[krb5_child[3650]]]] [create_ccache] (0x0020): 574: [13][Permission denied] So... here's some debug logs/configs: krb5_child log: http://paste.ubuntu.com/8095446/ sssd_kegs.local.log: http://paste.ubuntu.com/8095643/ krb5.conf: http://paste.ubuntu.com/8095464/ sssd.conf: http://paste.ubuntu.com/8095470/ # ls -alh /tmp total 16K drwxrwxrwx 2 root root 4.0K Aug 20 08:21 . drwxr-xr-x 22 root root 4.0K Jul 8 19:40 .. -rw------- 1 root root 7.4K Aug 20 07:19 krb5cc_0 I'm at a loss - anyone else able to tell me what's wrong or point me in the right direction? Cheers, Chris

3 5

LDAP bind with Session Tracking Control
by Michael Ströder 19 Aug '14

19 Aug '14

HI! Would be pretty cool if sssd would send the Session Tracking Control along with its LDAP bind requests when checking user's passwords. http://tools.ietf.org/html/draft-wahl-ldap-session LDAP servers which support this control (like OpenLDAP) can then log e.g. the SSH client's IP address along with received bind requests. Ciao, Michael.

2 2

Re: [SSSD-users] Caching credentials while online
by Jacob Weber 15 Aug '14

15 Aug '14

> I've marked #2408 as a duplicate of #1807. Sorry I made you file another > ticket, Jacob. But #1807 is present in 1.13 which is the next upstream > version we'll be working on and I doubt we'd had time to implement this > RFE sooner. No problem. I'm going to use mod_authz_ldap to deal with my Apache problem for now, since that has caching. But it would be nice to have some caching for normal logins, to reduce the load on the LDAP server. Jacob

1 0

Re: [SSSD-users] Caching credentials while online
by Jacob Weber 15 Aug '14

15 Aug '14

> Can you file a RFE? Sure: https://fedorahosted.org/sssd/ticket/2408 > Could you check in the logs what takes the longest during the whole > request? If your server is really fast, maybe you can add > debug_microseconds to the config file to increase the resolution.. I tried, but I'm not seeing a particular area that's slower than others. I can try looking more carefully when I have some time. The lookup doesn't make a huge difference in one request, but it adds up. In particular, this machine runs Subversion over Apache, and authenticates against the system users (using SSSD). Unfortunately SVN over Apache makes a ton of separate requests. Since SSSD doesn't cache, I'm probably going to look into having Apache use a method that does, like mod_ldap. > Maybe the new option could cover both the initgroups and authentication, > not sure. It's a bit of slippery slope, because on a Linux system > authentication is actually the only moment where groups are set. On the > other hand, group membership don't change that often.. Plus, if you're doing offline caching, you're already going down that slope... Jacob

5 5

Caching credentials while online
by Jacob Weber 14 Aug '14

14 Aug '14

Using SSSD with LDAP, is it possible to cache credentials for a period, even while online? I'd like to speed up authentication on certain servers. I have cache_credentials = true in sssd.conf. When I authenticate, I can see "Password successfully cached for [username]" in the log file. Then if I go offline, the cache is used. But while I'm online, it contacts the server each time. Thanks, Jacob

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users August 2014