sssd-users August 2015

sssd-users@lists.fedorahosted.org

26 participants
26 discussions

Faulty ldap query?
by Davor Vusir 17 Aug '15

17 Aug '15

Hello! I'm finetuning sssd and going through the logs. We're using AD as authentication source. SSSD is version 1.12.2 and seems to send a faulty query to the DC: My sAMAccountName is myLogonID but some queries passes the value of givenName. It searches the two defined ldap_search_base twice before it returns "No such entry". Followed by a query for "(unknown)". This query is only once per search base. See log below. Regards Davor Vusir --- (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [sysdb_gpo_get_gpo_result_setting] (0x0400): key [SeRemoteInteractiveLogonRight] value [*S-1-5-21-XXX-YYY-ZZZ-287220] (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [sysdb_gpo_get_gpo_result_setting] (0x0400): key [SeDenyRemoteInteractiveLogonRight] value [(null)] (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [parse_policy_setting_value] (0x0400): No value for key [SeDenyRemoteInteractiveLogonRight] found in gpo result (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): RESULTANT POLICY: (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): gpo_map_type: Remote Interactive (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): allowed_size = 1 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): allowed_sids[0] = S-1-5-21-XXX-YYY-ZZZ-287220 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): denied_size = 0 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): CURRENT USER: (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): user_sid = S-1-5-21-XXX-YYY-ZZZ-174590 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): group_sids[0] = S-1-5-21-XXX-YYY-ZZZ-50989 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): group_sids[1] = S-1-5-11 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): POLICY DECISION: (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): access_granted = 0 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): access_denied = 0 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_check] (0x0400): access denied: permissive mode (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [ad_gpo_access_done] (0x0400): GPO-based access control successful. (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>) [Success] (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler_callback] (0x0400): SELinux provider doesn't exist, not sending the request to it. (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler_callback] (0x0100): Sending result [0][ad.example.org] (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler_callback] (0x0100): Sent result [0][ad.example.org] (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_req_set_domain] (0x0400): Changing request domain from [ad.example.org] to [ad.example.org] (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler] (0x0100): Got request with the following data (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): command: PAM_SETCRED (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): domain: ad.example.org (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): user: myLogonID ~~~~~~~~~~~~~~~ ^ ~~ (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): service: sshd (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): tty: ssh (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): ruser: (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): rhost: client-1.subdomain.example.org (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): authtok type: 0 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): newauthtok type: 0 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): priv: 1 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): cli_pid: 4460 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): logon name: not set (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler] (0x0100): Sending result [0][ad.example.org] (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_req_set_domain] (0x0400): Changing request domain from [ad.example.org] to [ad.example.org] (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler] (0x0100): Got request with the following data (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): command: PAM_OPEN_SESSION (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): domain: ad.example.org (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): user: myLogonID (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): service: sshd (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): tty: ssh (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): ruser: (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): rhost: client-1.subdomain.example.org (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): authtok type: 0 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): newauthtok type: 0 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): priv: 1 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): cli_pid: 4460 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): logon name: not set (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler] (0x0100): Sending result [0][ad.example.org] (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_req_set_domain] (0x0400): Changing request domain from [ad.example.org] to [ad.example.org] (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler] (0x0100): Got request with the following data (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): command: PAM_SETCRED (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): domain: ad.example.org (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): user: myLogonID (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): service: sshd (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): tty: ssh (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): ruser: (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): rhost: client-1.subdomain.example.org (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): authtok type: 0 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): newauthtok type: 0 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): priv: 0 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): cli_pid: 4468 (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data] (0x0100): logon name: not set (Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler] (0x0100): Sending result [0][ad.example.org] (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [be_get_account_info] (0x0200): Got request for [0x1003][1][name=davor] ~~~~~~~~~~~~~~~ ^ ~~ (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [be_req_set_domain] (0x0400): Changing request domain from [ad.example.org] to [ad.example.org] (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org] (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=davor)(objectclass=user)(&(uidNumber=*)(!(uidNumber=0))))][ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org]. ~~~~~~~~~~~~~~~ ^ ~~ (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [ou=CT,dc=ad,dc=example,dc=org] (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=davor)(objectclass=user)(&(uidNumber=*)(!(uidNumber=0))))][ou=CT,dc=ad,dc=example,dc=org]. ~~~~~~~~~~~~~~~ ^ ~~ (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org] (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=davor)(objectclass=user)(&(uidNumber=*)(!(uidNumber=0))))][ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org]. ~~~~~~~~~~~~~~~ ^ ~~ (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [ou=CT,dc=ad,dc=example,dc=org] (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=davor)(objectclass=user)(&(uidNumber=*)(!(uidNumber=0))))][ou=CT,dc=ad,dc=example,dc=org]. ~~~~~~~~~~~~~~~ ^ ~~ (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sysdb_search_by_name] (0x0400): No such entry (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=(unknown)] (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [be_req_set_domain] (0x0400): Changing request domain from [ad.example.org] to [ad.example.org] (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org] (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=\28unknown\29)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))][ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org]. ~~~~~~~~~~~~~~~ ^ ~~ (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results. (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [ou=CT,dc=ad,dc=example,dc=org] (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=\28unknown\29)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))][ou=CT,dc=ad,dc=example,dc=org]. ~~~~~~~~~~~~~~~ ^ ~~ (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results. (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sdap_get_users_done] (0x0040): Failed to retrieve users (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sysdb_search_by_name] (0x0400): No such entry (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success

2 2

Logins stop working
by Thackeray, Neil L 11 Aug '15

11 Aug '15

I've gotten logins to work from our AD, but for some reason after a while they just stop working again. I'm using Ubuntu 14.04.1, sssd 1.12.5. I don't know why it's trying to contact the AD over 389. We only allow ldaps 636 connections to the AD. I'm not sure how it's initially allowing logins and then suddenly can't resolve the AD servers. Sssd log file: (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_step] (0x4000): beginning to connect (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc01.ad.mydomain.com' is 'name resolved' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc01.ad.mydomain.com' is 'not working' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc06.ad.mydomain.com' is 'name resolved' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc06.ad.mydomain.com' is 'not working' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc04.ad.mydomain.com' is 'name resolved' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc04.ad.mydomain.com' is 'not working' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc05.ad.mydomain.com' is 'name resolved' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc05.ad.mydomain.com' is 'not working' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc02.ad.mydomain.com' is 'name resolved' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc02.ad.mydomain.com' is 'not working' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc03.ad.mydomain.com' is 'name resolved' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc03.ad.mydomain.com' is 'not working' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'cdc02.ad.mydomain.com' is 'name resolved' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'cdc02.ad.mydomain.com' is 'not working' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'cdc01.ad.mydomain.com' is 'name resolved' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'cdc01.ad.mydomain.com' is 'not working' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD' (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): attempting failover retry on op #2 (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_step] (0x4000): waiting for connection to complete (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [child_sig_handler] (0x1000): Waiting for child [19728]. (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [child_sig_handler] (0x0100): child [19728] finished successfully. (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5 (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error]) (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_mark_offline] (0x2000): Going offline! (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_mark_offline] (0x2000): Enable check_if_online_ptask. (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_ptask_enable] (0x0400): Task [Check if online (periodic)]: enabling task (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_ptask_schedule] (0x0400): Task [Check if online (periodic)]: scheduling task 87 seconds from now [1439311309] (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks. (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #1 (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_subdomains_get_conn_done] (0x0080): No AD server is available, cannot get the subdomain list while offline (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #2 (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_dyndns_get_addrs_done] (0x0080): No LDAP server is available, dynamic DNS update is skipped in offline mode. (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_dyndns_update_addrs_done] (0x0040): Can't get addresses for DNS update (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158234]: Dynamic DNS update not possible while offline (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [1432158234]: Dynamic DNS update not possible while offline (Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection (Tue Aug 11 11:40:23 2015) [sssd[be[ad.mydomain.com]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.AD.MYDOMAIN.COM], [2][No such file or directory] sssd.conf [sssd] domains = ad.mydomain.com config_file_version = 2 services = nss, pam [nss] #debug_level = 9 [domain/ad.mydomain.com] debug_level = 9 ad_domain = ad.mydomain.com id_provider = ad auth_provider = ad access_provider = ad chpass_provider = ad override_gid = 760429 #krb5_realm = AD.MYDOMAIN.COM realmd_tags = manages-system joined-with-samba cache_credentials = True krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = False fallback_homedir = /home/%u ignore_group_members = False simple_allow_groups = Group 1, Group 2

2 1

sssd+ad-provider + sudo slow
by Евгений 11 Aug '15

11 Aug '15

Hi All! Work very well with sssd+ad provider, but sudo su - very slow working when running first time(running again <1sec), user1@host$ sudo su - ( slow ~ 8-15 sec). user1 domain user - member of many groups (+300) in Active Directory. /etc/sssd/sssd.conf: [domain/default] cache_credentials = true ignore_group_members = true [domain/domain.local] debug_level = 6 id_provider = ad ad_server = msa-dc13. domain.local, msk-dc11. domain.local ad_domain = domain.local ad_hostname = msa-mailsys1.domain.local override_homedir = /home/%u override_shell = /bin/bash ignore_group_members = true # FILTER access_provider = simple simple_allow_groups = ROL-Linux-Admin [sssd] services = nss, pam, sudo cache_credentials = true config_file_version = 2 domains = domain.local [nss] debug_level= 6 [pam] [sudo] #debug_level = 9 In /var/log/sssd/sssd_nss.log more requesting to domain,when run sudo first time. Whether it is possible to cache operations with sudo or or some other way to get around there is the problem? -- Eugene

5 14

SSSD configuration database load failure
by Caleb 10 Aug '15

10 Aug '15

Hi all, I'm trying to set up SSSD on a workstation with no success. Operating system is fully patched Ubuntu 14.04.3 Version info: $ sssd --version 1.11.5 sssd.conf: [sssd] debug_level = 0x4000 config_file_version = 2 services = nss,pam domains = FOO [nss] debug_level = 0xFFF0 filter_users = root filter_groups = root [pam] [domains/FOO] debug_level = 0xFFF0 auth_provider = krb5 krb5_server = kdc.redacted.com krb5_realm = REDACTED cache_credentials = true access_provider = simple chpass_provider = krb5 id_provider = ldap ldap_uri = ldap://ldap.redacted.com ldap_search_base = dc=redacted,dc=com ldap_id_use_start_tls = true ldap_sasl_mech = GSSAPI sudo_provider = none sssd.conf permissions: $ sudo ls -al /etc/sssd/sssd.conf -rw------- 1 root root 543 Aug 9 14:30 /etc/sssd/sssd.conf Output when run from commandline: $ sudo /usr/sbin/sssd -i -d7 (Sun Aug 9 15:01:19:105688 2015) [sssd] [ldb] (0x0400): server_sort:Unable to register control with rootdse! (Sun Aug 9 15:01:19:106021 2015) [sssd] [add_implicit_services] (0x0040): id_provider is not set for domain [FOO], trying next domain. (Sun Aug 9 15:01:19:106120 2015) [sssd] [confdb_get_domain_internal] (0x0010): Unknown domain [FOO] (Sun Aug 9 15:01:19:106154 2015) [sssd] [confdb_get_domains] (0x0010): Error (2 [No such file or directory]) retrieving domain [FOO], skipping! (Sun Aug 9 15:01:19:106186 2015) [sssd] [confdb_get_domains] (0x0010): No properly configured domains, fatal error! (Sun Aug 9 15:01:19:106210 2015) [sssd] [get_monitor_config] (0x0010): No domains configured. (Sun Aug 9 15:01:19:106255 2015) [sssd] [main] (0x0020): SSSD couldn't load the configuration database. Near as I can tell, the error about a missing id_provider is a baldfaced lie--the `id_provider = ldap` line clearly exists in sssd.conf, and this exact configuration is working on another fully patched Ubuntu 14.04.3 system on the same network--but I haven't a clue about the error's root cause. I'm also unable to find any information about the missing file that is causing the `No such file or directory` error. Based on some older posts to this list, I tried installing and running ldbsearch on `/var/lib/sss/db/config.ldb`: $ sudo ldbsearch -H /var/lib/sss/db/config.ldb server_sort:Unable to register control with rootdse! # record 1 dn: cn=sssd,cn=config cn: sssd config_file_version: 2 debug_level: 0x4000 domains: FOO services: nss,pam distinguishedName: cn=sssd,cn=config # record 2 dn: cn=config version: 2 lastUpdate: 1439155822 distinguishedName: cn=config # record 3 dn: cn=nss,cn=config cn: nss debug_level: 0xFFF0 filter_groups: root filter_users: root distinguishedName: cn=nss,cn=config # record 4 dn: cn=FOO,cn=domains,cn=config access_provider: simple auth_provider: krb5 cache_credentials: true chpass_provider: krb5 cn: FOO debug_level: 0xFFF0 id_provider: ldap krb5_realm: REDACTED krb5_server: kdc.redacted.com ldap_id_use_start_tls: true ldap_sasl_mech: GSSAPI ldap_search_base: dc=redacted,dc=com ldap_uri: ldap://ldap.redacted.com sudo_provider: none distinguishedName: cn=FOO,cn=domains,cn=config # record 5 dn: cn=pam,cn=config cn: pam distinguishedName: cn=pam,cn=config # returned 5 records # 5 entries # 0 referrals config.ldb permissions: $ ls -al /var/lib/sss/db/config.ldb -rw------- 1 root root 1286144 Aug 9 15:16 /var/lib/sss/db/config.ldb So that seems to be in order. I examined the source code, but wasn't able to trace the flow of execution past `confdb_get_param` At this point, I know of no other troubleshooting or debugging options, even after reading through the various related documents scattered about the Internet. Looking at file access patterns with `strace` didn't yield any useful information either. What else could be causing this issue? Cheers, -Caleb

2 2

SSSD 1.12.2 Active Directory inconsistent group membership
by Isaiah Houston 04 Aug '15

04 Aug '15

Hi, I am having a hard time tracking down an issue with SSSD 1.12.2 on Amazon Linux (Amazon Linux only recently added SSSD to their yum repository, and 1.12.2 is the highest available version). My user can authenticate to a Samba 4 directory server, but once logged in, the “id” or “groups” command only displays the primary group, in this case the “Domain Users” group: uid=1115600500(administrator@[domain]) gid=1115600513(domain users@[domain]) groups=1115600513(domain users@[domain]) I want additional group memberships to be displayed so I can do things like allow members of the Domain Admins group to have sudo access. Via ldapsearch, I can see that my user is correctly a member of additional groups. If I stop the sssd service, delete files in /var/lib/sss/mc and /var/lib/sss/db, and restart the service, all the groups are listed correctly: uid=1115600500(administrator@[domain]) gid=1115600513(domain users@[domain]) groups=1115600513(domain users@[domain]),1115600512(domain admins@[domain]),1115600518(schema admins@[domain]),1115600519(enterprise admins@[domain]),1115600520(group policy creator owners@[domian]),1115600572(denied rodc password replication group@[domain]) However, as soon as I log out and log back in, the problem occurs again and persists until I repeat the process of deleting the sssd cached files and restarting sssd. This is my sssd.conf file: [sssd] domains = [domain] config_file_version = 2 services = nss, pam [domain/[domain]] ad_domain = [domain] krb5_realm = [domain] realmd_tags = manages-system joined-with-samba cache_credentials = False id_provider = ad krb5_store_password_if_offline = False default_shell = /bin/bash ldap_id_mapping = True ldap_schema = ad use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = ad An additional issue is that sometimes when I log in, the login process fails to complete. In the messages log, I see the following: kernel: [344799.794025] sssd_be[13204]: segfault at 10000 ip 00007f7b73965144 sp 00007ffe53541e70 error 4 in libsss_idmap.so.0.4.0[7f7b73962000+5000] sssd[be[domain]]: Starting up However, this does not always happen. I am not sure if this issue is related, but since it segfaults when calling idmap I suspect they are. Any ideas on what to do next would be appreciated!

2 1

Map an AD group to a local group
by Domenico Viggiani 01 Aug '15

01 Aug '15

Hi, to preserve compatibility, I'd like to map the AD users' default group to a local Linux group. I don't want to add every AD user to the row in /etc/group and I don't want to change default primary group of users in AD. Is there a group mapping function in SSSD? Or am I completely wrong? Thanks in advance -- Domenico Viggiani

4 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users August 2015