sssd-users May 2016

sssd-users@lists.fedorahosted.org

18 participants
15 discussions

Enumerate users from external group from AD trust
by Bolke de Bruin 29 Nov '19

29 Nov '19

Hello, I have sssd 1.13.00 working against FreeIPA 4.2 domain. This domain has a trust relationship with a active directory domain. One of the systems we are using requires to enumerate all users in groups by (unfortunate) design (Apache Ranger). This is done by using “getent group”. During this enumeration the full user list for a group that has a nested external member group* is not always returned so we thought to add “getent group mygroup” in order to get more details. Unfortunately this does not seem to work consistently: sometimes this gives information sometimes it does not: [root@master centos]# getent group ad_users ad_users:*:1950000004: [root@master centos]# id bolke(a)ad.local UID=1796201107(bolke(a)ad.local) GID=1796201107(bolke(a)ad.local) groepen=1796201107(bolke(a)ad.local),1796200513(domain users@ad.local),1796201108(test@ad.local) [root@master centos]# getent group ad_users ad_users:*:1950000004:bolke@ad.local <mailto:bolke@ad.local> If I clear the cache (sss_cache -E) the entry is gone again: [root@master centos]# getent group ad_users ad_users:*:1950000004: My question is how do I get sssd to enumerate *all users* in a group consistently? Thanks! Bolke * https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/trust-gro…

3 15

full_name_format and supplemental groups
by Orion Poplawski 25 Oct '16

25 Oct '16

Running IPA with an AD trust. Users are in AD. Trying to use full_name_format = %1$s to strip the domain from user names. This appears to break supplemental groups in strange ways. On the IPA server: Without full_name_format: # id orion(a)ad.nwra.com uid=470202603(orion(a)ad.nwra.com) gid=470202603(orion(a)ad.nwra.com) groups=470202603(orion(a)ad.nwra.com),470200513(domain users(a)ad.nwra.com),470204703(pirep rd users(a)ad.nwra.com),470204714(wireless access@ad.nwra.com),470204715(nwra-users@ad.nwra.com),470204701(boulder@ad.nwra.com),470207608(heimdall users(a)ad.nwra.com),470200512(domain admins(a)ad.nwra.com),470207124(andreas admins(a)ad.nwra.com) With: # id orion(a)ad.nwra.com uid=470202603(orion) gid=470202603(orion) groups=470202603(orion) If I add: default_domain_suffix = ad.nwra.com # id orion uid=470202603(orion) gid=470202603(orion) groups=470202603(orion),470200512(domain admins),470207608(heimdall users),470204714(wireless access),470204715(nwra-users),470204701(boulder),470204703(pirep rd users),470207124(andreas admins),470200513(domain users) Which I guess makes some sense as you'd need to add the domain suffix back on to find the groups. But this appears to completely break IPA clients (with full_name_format = %1$s and default_domain_suffix = ad.nwra.com): # id orion(a)ad.nwra.com id: orion(a)ad.nwra.com: no such user # id orion id: orion: no such user >From looking at the server logs, it looks like only the IPA domain is searched If I reset the server back to normal (drop full_name_format and default_domain_suffix): # id orion uid=470202603(orion) gid=470202603(orion) groups=470202603(orion) I don't get any supplemental groups. I see sssd errors like: (Mon Mar 30 15:20:52 2015) [sssd[be[nwra.com]]] [sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory) (Mon Mar 30 15:20:52 2015) [sssd[be[nwra.com]]] [sysdb_update_members_ex] (0x0020): Could not add member [orion] to group [name=domain admins,cn=groups,cn=nwra.com,cn=sysdb]. Skipping. Is t trying "cn=groups,cn=nwra.com,cn=sysdb" instead of "cn=groups,cn=ad.nwra.com,cn=sysdb" -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

3 7

netlink messages on Infiniband causing sssd to exit
by Ryan Novosielski 19 Aug '16

19 Aug '16

Over time, I’ve been having seemingly random sssd quits that I’ve not been able to figure out. Today, I finally traced it to fluctuations on my Infiniband fabric: sssd.log (Tue Nov 3 13:17:59 2015) [sssd] [message_type] (0x0200): netlink Message type: 16 (Tue Nov 3 13:17:59 2015) [sssd] [link_msg_handler] (0x1000): netlink link message: iface idx 4 (ib0) flags 0x1003 (broadcast,multicast,up) (Tue Nov 3 13:17:59 2015) [sssd] [message_type] (0x0200): netlink Message type: 16 (Tue Nov 3 13:17:59 2015) [sssd] [link_msg_handler] (0x1000): netlink link message: iface idx 4 (ib0) flags 0x11043 (broadcast,multicast,up,running,lower) This exactly corresponds to the time in /var/log/messages for the unexplained shutdown: 2015-11-03T13:17:59-05:00 node75 sssd[pam]: Shutting down 2015-11-03T13:17:59-05:00 node75 sssd[be[default]]: Shutting down 2015-11-03T13:17:59-05:00 node75 sssd[nss]: Shutting down Here is sssd_default.log for good measure: (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sbus_remove_watch] (0x2000): 0x1414770/0x14133d0 (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sbus_remove_watch] (0x2000): 0x1414770/0x13fef90 (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [be_ptask_destructor] (0x0400): Terminating periodic task [Cleanup of default] (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sdap_handle_release] (0x2000): Trace: sh[0x14bd850], connected[1], ops[(nil)], ldap[0x1424260], destructor_lock[0], release_memory[0] (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_connection_callback] (0x4000): Successfully removed connection callback. (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sbus_remove_watch] (0x2000): 0x1415970/0x1416430 (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_socket_symlink] (0x4000): The symlink points to [/var/lib/sss/pipes/private/sbus-dp_default.18702] (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_socket_symlink] (0x4000): The path including our pid is [/var/lib/sss/pipes/private/sbus-dp_default.18702] (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_socket_symlink] (0x4000): Removed the symlink (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [be_client_destructor] (0x0400): Removed PAM client (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [be_client_destructor] (0x0400): Removed NSS client I can duplicate this by manually taking down the Infiniband link: [root@node24 ~]# service sssd status sssd (pid 9132) is running... [root@node24 ~]# ifdown ib0 [root@node24 ~]# service sssd status sssd dead but pid file exists I have also noticed that sssd will not start on boot. As I know that Infiniband tends to flutter a little bit before the link comes up, I’m thinking this is probably the same cause. Can anyone explain this behavior and tell me what I might do to prevent it? -- ____ *Note: UMDNJ is now Rutgers-Biomedical and Health Sciences* || \\UTGERS |---------------------*O*--------------------- ||_// Biomedical | Ryan Novosielski - Senior Technologist || \\ and Health | novosirj(a)rutgers.edu - 973/972.0922 (2x0922) || \\ Sciences | OIRT/High Perf & Res Comp - MSB C630, Newark `'

5 7

SSSD in RHEL 6.8
by Ondrej Valousek 27 May '16

27 May '16

Hi Team, First of all, many thanks for sssd-13.3 which has finally found its way into RH-6.8. It seems to be first release I can use in my environment without having to use any obscure hacks I hated from the very beginning. Good work! I also noticed that this version can (seems like) finally refresh machine account in AD/IPA domain. Unfortunately this does not seem to work for me: (Wed May 25 09:14:08 2016) [sssd[be[default]]] [be_ptask_schedule] (0x0400): Task [AD machine account password renewal]: scheduling task 86400 seconds from now [1464246848] (Wed May 25 09:15:08 2016) [sssd[be[default]]] [ad_machine_account_password_renewal_timeout] (0x0020): Timeout reached for AD renewal child. (Wed May 25 09:15:08 2016) [sssd[be[default]]] [be_ptask_done] (0x0040): Task [AD machine account password renewal]: failed with [1432158266]: AD renewal child failed What could be wrong? Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

5 9

SSSD AD Login problems
by Jason Ellul 26 May '16

26 May '16

Hi All, Last week I bound my computer to Active Directory and everything was working fine but as of today authentication has started to fail. SSSD log In the logs (debug = 7) I see: (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_resolve_server_process] (0x0200): Found address for server pmc-dc2.petermac.org.au: [172.23.8.18] TTL 3600 (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://pmc-dc2.petermac.org.au' (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://pmc-dc2.petermac.org.au' (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [write_pipe_handler] (0x0400): All data has been sent! (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [main] (0x0400): krb5_child started. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [unpack_buffer] (0x1000): total buffer size: [136] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [unpack_buffer] (0x0100): cmd [241] uid [1501] gid [1501] validate [true] enterprise principal [true] offline [false] UPN [Ellul Jason(a)PETERMAC.ORG.AU] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [unpack_buffer] (0x0100): ccname: [KEYRING:persistent:1501] old_ccname: [not set] keytab: [/etc/krb5.keytab] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [check_use_fast] (0x0100): Not using FAST. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [privileged_krb5_setup] (0x0080): Cannot open the PAC responder socket (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [become_user] (0x0200): Trying to become user [1501][1501]. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [main] (0x0400): Will perform online auth (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [tgt_req_child] (0x1000): Attempting to get a TGT (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [PETERMAC.ORG.AU] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [validate_tgt] (0x0020): TGT failed verification using key for [LA35185$(a)PETERMAC.ORG.AU]. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [get_and_save_tgt] (0x0020): 1240: [-1765328340][Cannot find key for LA35185$(a)PETERMAC.ORG.AU kvno 3 in keytab] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [map_krb5_error] (0x0020): 1301: [-1765328340][Cannot find key for LA35185$(a)PETERMAC.ORG.AU kvno 3 in keytab] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [k5c_send_data] (0x0200): Received error code 1432158209 (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [main] (0x0400): krb5_child completed successfully (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [read_pipe_handler] (0x0400): EOF received, client finished (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [parse_krb5_child_response] (0x1000): child response [1432158209][6][8]. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [check_wait_queue] (0x1000): Wait queue for user [Ellul Jason] is empty. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [krb5_auth_queue_done] (0x1000): krb5_auth_queue request [0x555f73e8b420] done. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 4, <NULL>) [Success] (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_pam_handler_callback] (0x0100): Sending result [4][petermac.org.au] (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_pam_handler_callback] (0x0100): Sent result [4][petermac.org.au] (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [child_sig_handler] (0x1000): Waiting for child [6572]. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [child_sig_handler] (0x0100): child [6572] finished successfully. (Mon May 23 17:18:58 2016) [sssd[pam]] [pam_dp_process_reply] (0x0200): received: [4 (System error)][petermac.org.au] (Mon May 23 17:18:58 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [4]: System error. (Mon May 23 17:18:58 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 32 (Mon May 23 17:18:58 2016) [sssd[pam]] [client_recv] (0x0200): Client disconnected! (Mon May 23 17:18:59 2016) [sssd[nss]] [client_recv] (0x0200): Client disconnected! [root@la35185 jellul]# klist -k -t /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ----------------- -------------------------------------------------------- 2 23/05/16 12:55:53 LA35185$(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 LA35185$(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 LA35185$(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 LA35185$(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 LA35185$(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:54 RestrictedKrbHost/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:54 RestrictedKrbHost/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:54 RestrictedKrbHost/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:54 RestrictedKrbHost/la35185.petermac.org.au(a)PETERMAC.ORG.AU Many thanks Jason

3 5

sudoRole sudoUser syntax? plugin?
by Mote, Todd 25 May '16

25 May '16

So I've extended my AD and created a sudoRole in an OU, and can get it to work for a single user. I can't however get it to work with an AD group. I've tried %<adgroupname>, <adgroupname>, and +<adgroupname> all in the sudoUser attribute on the object, but cannot get it to use the group. Getent group <adgroupname> returns members. Reading the Sudoers LDAP Manual has this to say for sudoUser: "A user name, user ID (prefixed with '#'), Unix group name or ID (prefixed with '%' or '%#' respectively), user netgroup (prefixed with '+'), or non-Unix group name or ID (prefixed with '%:' or '%:#' respectively). User netgroups are matched using the user and domain members only; the host member is not used when matching. Non-Unix group support is only available when an appropriate group_plugin is defined in the global defaults sudoRole object." So is it reasonable to assume the last sentence is tripping this up? Does a group_plugin need to be defined in defaults? What group_plugin needs to be defined in defaults? It all works fine with just a single user in the sudoUser attribute. Once I replace it with %<adgroupname>, the same way I put it in the sudoers file manually, it fails to match the rule. From sssd_sudo.log When just my user is listed specifically in the sudoUser attribute in the sudoRole object in AD: [sudosrv_get_sudorules_query_cache] (0x0200):Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=myaduser)(sudoUser=#1165)(sudoUser=%Domain\20Users)(sudoUser=%<adgroupname1>)(sudoUser=%<adgroupname2>)(sudoUser=%<adgroupnameiwanttouse>) ... [sort_sudo_rules] (0x0400): Sorting rules with higher-wins logic [sudosrv_get_sudorules_from_cache] (0x0400): Returning 1 rules for [myaduser(a)mydomain.com] When a group my user is in, is in the sudoUser attribute in the sudoRole object in AD: [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=myaduser)(sudoUser=#1165)(sudoUser=%Domain\20Users)(sudoUser=%<adgroupname1>)(sudoUser=%<adgroupname2>)(sudoUser=%<adgroupnameiwanttouse>) ... [sudosrv_get_sudorules_from_cache] (0x0400): Returning 0 rules for [myaduser(a)mydomain.com] I've tried matching case with the filter that's in sssd_sudo.log, I've tried matching case from id $user, nothing seems to work but listing my user account specifically. Is there some magic to getting AD groups to work with SUDO LDAP objects? Todd

2 1

SSSD AD Login problems
by Jason Ellul 23 May '16

23 May '16

Hi All, Last week I bound my computer to our local windows domain. As of today I started receiving Authentication errors: Debug_Log = 7 (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_req_set_domain] (0x0400): Changing request domain from [petermac.org.au] to [petermac.org.au] (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_pam_handler] (0x0100): Got request with the following data (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): domain: petermac.org.au (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): user: Ellul Jason (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): service: su-l (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): tty: pts/2 (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): ruser: jellul (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): rhost: (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): authtok type: 1 (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): newauthtok type: 0 (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): priv: 0 (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): cli_pid: 6067 (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [pam_print_data] (0x0100): logon name: not set (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [krb5_auth_queue_send] (0x1000): Wait queue of user [Ellul Jason] is empty, running request [0x555f73e8b420] immediately. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [sysdb_search_override_by_name] (0x0400): No user override found for name [Ellul Jason]. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [krb5_auth_prepare_ccache_name] (0x1000): No ccache file for user [Ellul Jason] found. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [get_server_status] (0x1000): Status of server 'pmc-dc2.petermac.org.au' is 'working' (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [get_port_status] (0x1000): Port status of port 389 for server 'pmc-dc2.petermac.org.au' is 'working' (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [get_server_status] (0x1000): Status of server 'pmc-dc2.petermac.org.au' is 'working' (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_resolve_server_process] (0x0200): Found address for server pmc-dc2.petermac.org.au: [172.23.8.18] TTL 3600 (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://pmc-dc2.petermac.org.au' (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://pmc-dc2.petermac.org.au' (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [write_pipe_handler] (0x0400): All data has been sent! (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [main] (0x0400): krb5_child started. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [unpack_buffer] (0x1000): total buffer size: [136] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [unpack_buffer] (0x0100): cmd [241] uid [1501] gid [1501] validate [true] enterprise principal [true] offline [false] UPN [Ellul Jason(a)PETERMAC.ORG.AU] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [unpack_buffer] (0x0100): ccname: [KEYRING:persistent:1501] old_ccname: [not set] keytab: [/etc/krb5.keytab] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [check_use_fast] (0x0100): Not using FAST. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [privileged_krb5_setup] (0x0080): Cannot open the PAC responder socket (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [become_user] (0x0200): Trying to become user [1501][1501]. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [main] (0x0400): Will perform online auth (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [tgt_req_child] (0x1000): Attempting to get a TGT (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [PETERMAC.ORG.AU] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [validate_tgt] (0x0020): TGT failed verification using key for [LA35185$(a)PETERMAC.ORG.AU]. (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [get_and_save_tgt] (0x0020): 1240: [-1765328340][Cannot find key for LA35185$(a)PETERMAC.ORG.AU kvno 3 in keytab] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [map_krb5_error] (0x0020): 1301: [-1765328340][Cannot find key for LA35185$(a)PETERMAC.ORG.AU kvno 3 in keytab] (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [k5c_send_data] (0x0200): Received error code 1432158209 (Mon May 23 17:18:58 2016) [[sssd[krb5_child[6572]]]] [main] (0x0400): krb5_child completed successfully (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [read_pipe_handler] (0x0400): EOF received, client finished (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [parse_krb5_child_response] (0x1000): child response [1432158209][6][8]. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [check_wait_queue] (0x1000): Wait queue for user [Ellul Jason] is empty. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [krb5_auth_queue_done] (0x1000): krb5_auth_queue request [0x555f73e8b420] done. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 4, <NULL>) [Success] (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_pam_handler_callback] (0x0100): Sending result [4][petermac.org.au] (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [be_pam_handler_callback] (0x0100): Sent result [4][petermac.org.au] (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [child_sig_handler] (0x1000): Waiting for child [6572]. (Mon May 23 17:18:58 2016) [sssd[be[petermac.org.au]]] [child_sig_handler] (0x0100): child [6572] finished successfully. (Mon May 23 17:18:58 2016) [sssd[pam]] [pam_dp_process_reply] (0x0200): received: [4 (System error)][petermac.org.au] (Mon May 23 17:18:58 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [4]: System error. (Mon May 23 17:18:58 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 32 (Mon May 23 17:18:58 2016) [sssd[pam]] [client_recv] (0x0200): Client disconnected! (Mon May 23 17:18:59 2016) [sssd[nss]] [client_recv] (0x0200): Client disconnected! (Mon May 23 17:20:10 2016) [sssd[nss]] [accept_fd_handler] (0x0400): Client connected! and [root@la35185 jellul]# klist -k -t /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ----------------- -------------------------------------------------------- 2 23/05/16 12:55:53 LA35185$(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 LA35185$(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 LA35185$(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 LA35185$(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 LA35185$(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 HOST/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/LA35185(a)PETERMAC.ORG.AU 2 23/05/16 12:55:53 RestrictedKrbHost/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:54 RestrictedKrbHost/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:54 RestrictedKrbHost/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:54 RestrictedKrbHost/la35185.petermac.org.au(a)PETERMAC.ORG.AU 2 23/05/16 12:55:54 RestrictedKrbHost/la35185.petermac.org.au(a)PETERMAC.ORG.AU Any help you could provide would be greatly appreciated. Many thanks Jason

1 0

LDAP
by Irfan 18 May '16

18 May '16

Hi Team, We have changed the property enumerate to true in etc/sssd/sssd.conf file. After this change in RStudio-server All LDAP authenticated user were loaded. But it's has impacted the server performance and other user were facing the issues. we wanted to add only 3 LDAP authenticated users in this list. Do we have any other way than changing enumerate property to give access only to 3 users? Could you please guide us on this. Thanks, Irfan

5 9

SSSD and docker
by Ondrej Valousek 11 May '16

11 May '16

Hi list, Question: Can SSSD provide its services for containerized apps? Is there any howto around? Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

3 4

Question about aliases database in nsswitch.conf
by Pierre Aho 09 May '16

09 May '16

Hi, Using legacy daemon "nslcd" with "aliases: files ldap" switch in nsswitch.conf I can list all aliases from our ldap backend using "getent -s ldap aliases". If I switch to sssd and trying "aliases: files sss" in nsswitch.conf, "getent -s sss aliases" query is empty. also note that in our environment "nslcd.conf" had to be tweaked using these entries for "getent aliases" to work: filter aliases (objectClass=mailRecipient) map aliases rfc822MailMember mail I wonder if sssd support caching aliases database like nslcd does? - If it does, how can I configure sssd to filter and map the aliases queries like nslcd.conf above? - If not will it be supported in the future? Regards, Pierre

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users May 2016