sssd-users August 2019

sssd-users@lists.fedorahosted.org

25 participants
26 discussions

sssd backend not workin on ubuntu 18.04
by Charles Hedrick 02 Sep '19

02 Sep '19

On our Ubuntu 18.04 servers, sssd won’t start. Logging shows that it can’t find any DNS servers. Restarting sssd fixes it. /etc/resolv.conf is a symlink to ../run/systemd/resolve/stub-resolv.conf If I replace that with a hardcoded resolv.conf with the right name server, sssd comes up. Network Manager replaces the file with a different one pointing to nameserver 127.0.0.53, but after another reboot with that file it still works. This happens on 4 identical servers, but not on a VM with the same OS. I assume there’s a timing issue of some sort.

4 5

another ubuntu 18 sssd issue: cron
by Charles Hedrick 29 Aug '19

29 Aug '19

After converting a system to sssd with an IPA backend, we found that cron was not recognizing our users. It appears (based on using lsof to see what .so files are open) that cron is reading nsswitch.conf at startup, and doesn’t notice the change when sssd setup adds sss to the user map in nsswitch.conf. Restarting cron fixes it, but we’ve now got another Ubuntu-specific hack in our Ansible setup script.

2 3

Patch for sssd to fix recursion problems with Winbind (Samba Bug #13815)
by Heiko Wundram 23 Aug '19

23 Aug '19

Hello list, for a deployment I'm administering, I'm using winbind and sssd in parallel, both for different authentication sources (so it's not about their interoperability, but rather about using them in parallel). It seems that sssd has/had a bug which meant that winbind 4.8+ and sssd, if used together as NSS sources, would, for unavailable accounts in both authentication sources, lead to a DoS against winbind due to recursive calls of the NSS infrastructure. I'm deploying winbind (for a Windows Domain) and sssd (for an LDAP authentication source with client certificate authentication) on Debian 10. Samba tracked this as bug #13815 (https://bugzilla.samba.org/show_bug.cgi?id=13815), which contains a link to a corresponding issue in the RedHat bugtracker (https://bugzilla.redhat.com/show_bug.cgi?id=1666819), which supposedly contains a patch for the behaviour; as the bug isn't open, I can neither see what the patch actually is, nor can I prepare the patch for the Debian packaging of sssd. Can anybody shed some light on what the patch is (and/or link to the commit in Pagure), specifically also which published version the patch is contained in, so that I might either decide to deploy updated sssd packages for Debian, or even try to backport the patch to the Debian built-in version? I can't find a means to search commits in Pagure, that's why I'm asking here, but even just that would be helpful. Thanks in advance! -- --- Heiko Wundram.

3 2

issue with ldap_access_filter
by Kamil Kosowski 22 Aug '19

22 Aug '19

Hello I am doing some reverse engineering in my current company : I have a server which is acting as a gateway for other services, it's like entry point exposed to the world. People are connecting to this server on port 443 via for example DBeaver. The same server can be accessed by a group of admin via ssh - ssh should be only for admins, admins are placed in the different domain while all other users are in domain.net for clarification group, "NoOne" doesn't exist in AD what is happening : - if someone is trying to access this node via ssh, I see in the SSSD logs that, after validating user, SSSD is performing access check filter and that is ok - if someone is trying to access this node via DBeaver on port 443, SSSD never triggers access check filter after user validation and the user gets access if there is any way to exclude performing access_filter for every connection except ssh? I cannot find this configuration and apparently, this is how it works right now, while I am deploying new Gateway server with the same configuration and on the new server no matter what I do, access_filter check is always triggered config: [domain/admins.net] allow ssh config [domain/domain.net] debug_level = 9 id_provider = ldap auth_provider = ldap access_provider = ldap ldap_uri = ldaps://node.net:636 ldap_user_search_base = DC=domain,DC=NET?subtree?(|(memberOf=CN=DSP,OU=Security,OU=Groups,OU=Town,OU=PL,OU=COMP,OU=Users & Workstations,DC=domain,DC=NET)(memberOf=CN=IMD,OU=Security,OU=IMD,OU=Global,OU=Users & Workstations,DC=domain,DC=NET)) ldap_schema = ad ldap_id_mapping = True ldap_default_bind_dn = CN=USERMASTER,OU=Service Accounts,OU=Global,OU=Servers,DC=domain,DC=NET ldap_default_authtok = ################ ldap_user_name = sAMAccountName ldap_user_member_of = memberOf ldap_user_gid_number = primaryGroupID ldap_user_shell = /bin/bash override_homedir = /home/%u ldap_group_name = sAMAccountName ldap_group_search_base = DC=domain,DC=NET?subtree?(|(cn=Data*)(cn=Users)) ldap_use_tokengroups = false ldap_group_member = member ldap_group_object_class = group ldap_sudorule_object_class = person ldap_sudorule_name = sAMAccountName cache_credentials = True use_fully_qualified_names = False ldap_tls_cacert = /etc/sssd/ROOT_AD_RO.pem ldap_access_order = filter ldap_access_filter = (|(memberOf=NoOne,DC=domain,DC=NET)

2 1

Issues with upgrade from 1.16.3 to 2.2.0 release
by cedric hottier 20 Aug '19

20 Aug '19

Dear SSSD users, I would like to share with you few issues I faced during the move from 1.16.3 to 2.2.0 sssd release. I am a Debian user and I did this move because Debian pushed the 2.2.0 release in the testing branch. My configuration may seem exotic as I use 'files' as id_provider and 'krb5' as auth_provider. Initially with the 1.16 version I faced the following issue : https://pagure.io/SSSD/sssd/issue/3591 Thanks to Jakub Hrozek <https://lists.fedorahosted.org/archives/users/59805023105315470299316859196…>, I was able to make it working with the following workaround : id_provider=proxy proxy_lib_name=files For those interested, the discussion thread is here : https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… With the move to 2.2.0, I faced several issues... First, I had to remove the line services = nss, pam, ifp from sssd.conf because I use systemd. I think i fell in the bug described here : https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=886483 . I do not know if it is a debian specific integration issue, or a sssd issue. I did not find any reference to sssd upstream bug, but in the meantime, it is written that "We believe that the bug you reported is fixed in the latest version of sssd" . Not clear for me if they are talking about sssd debian package version, or upstream version. Anyway, I faced this issue with new debian package 2.2.0, let me know if it is a debian specific stuff to open a bug report on debian side. Once the previous issue was fixed, I faced a segmentation fault in libsss_proxy.so. Sorry to not have the exact error message. But it should be easy to reproduce. id_provider = files auth_provider = krb5 should show the issue. Due to this seg fault, I removed the workaround of the bug 3591. sssd was properly started by systemd, but, I realized, that the bug 3591, is still not fixed. I am afraid I am locked with 1,16,3 release. ( who does the job, but not aligned with debian testing ) Thanks for your feedback Kind Regards Cedric

3 4

issues with renewal of service tickets
by Peter Tulpen 16 Aug '19

16 Aug '19

3 3

sssd smartcard pam.d
by Eremeev Vladimir 16 Aug '19

16 Aug '19

Hello for all. I have CentOS 7.6 with last updates. After using realmd authetification AD users with password works well. I try to use smartcards to authetificate users from AD at the linux machines. After a lot of googling I can use PKINIT to take kerberos tickets for a user by using a smartcard and a pincode. this is my krb5.conf: # cat /etc/krb5.conf # Configuration snippets may be placed in this directory as well includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_ccache_name = KEYRING:persistent:%{uid} default_realm = "Domain" pkinit_anchors = FILE:/etc/pki/nssdb/ca.cer pkinit_identities = PKCS11:/usr/lib64/libeTPkcs11.so pkinit_eku_checking = kpServerAuth pkinit_kdc_hostname = "Domain controller1" pkinit_kdc_hostname = "Domain controller2" pkinit_kdc_hostname = "Domain controller3" canonicalize = True [realms] "Domain" { kdc = "Domain controller1" kdc = "Domain controller2" kdc = "Domain controller3" admin_server = "Domain controller1" default_domain = "Domain" } [domain_realm] domain = DOMAIN .domain = DOMAIN I put this article inside sssd.conf: [pam] pam_cert_auth = true i think that next step will be a configure pam.d files. but at this step a met some problems. maybe somebody can send me working files from pam.d? What the next step to make authetification for Gnome Destop on CentOS 7.6? ps. "authconfig --enablesssd --enablesssdauth --enablesmartcard --smartcardmodule=sssd --smartcardaction=1 --updateall" don't work well for me

2 1

Replacement for Centrify adcert command
by James Cassell 15 Aug '19

15 Aug '19

Good afternoon, I'm working on a migration from Centrify to SSSD with Active Directory. Everything works quite well except for one item. Centrify has a feature to request a certificate from the AD CA that is automatically granted, given the AD credentials. This is used for wired 802.1x authentication, among other things. Is there a way to get an AD cert via SSSD or related tools such as adcli? (Centrify calls this command 'adcert'.) Thanks in advance! V/r, James Cassell

3 3

pam_sss nullok
by Winberg Adam 15 Aug '19

15 Aug '19

Hello all, when using smart card auth with pam_pkcs11 there is an option to set 'nullok' to true/false. Setting it to false effectively makes pam_pkcs11 ignore empty pin entries (this option is also available for pam_unix and set to false as default). So if I get a pin prompt and just press Enter it is not regarded as an authentication attempt. Is there anything similar with pam_sss? Default behaviour seems to be to regard empty inputs as an auth attempt, so if I run sudo and just press Enter a couple of times this counts as failed auth attempts and will consequently lock my smart card. Which is not what I want.

2 2

Problem getting sssd to work with LDAP authentication
by Jane Eason 13 Aug '19

13 Aug '19

Hello, We are attempting to get LDAP logins set up with sssd on RHEL 7.6. sssd is able to look up the user against the backend LDAP using a secure connection on port 636. However, it does not attempt to authenticate. We think pam authentication is not getting called for remote logins. Local logins are working. On the ldap server, we can see the search but not an authentication attempt. In case it matters: We don't store the POSIX uid in LDAP. Where should we look for the missing setting(s)? Some log snips follow. In /var/log/secure on the client vm, we see: Aug 8 16:45:32 clientvm polkitd[5652]: Registered Authentication Agent for unix-process:8478:2629285 (system bus name :1.92 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) Aug 8 16:45:32 clientvm polkitd[5652]: Unregistered Authentication Agent for unix-process:8478:2629285 (system bus name :1.92, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) Aug 8 16:45:53 clientvm unix_chkpwd[8491]: password check failed for user (myuser) Aug 8 16:45:53 clientvm sshd[8489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=REDACTED user=myuser Aug 8 16:45:53 clientvm sshd[8489]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=REDACTED user=myuser Aug 8 16:45:53 clientvm sshd[8489]: pam_sss(sshd:auth): received for user myuser: 10 (User not known to the underlying authentication module) Aug 8 16:45:55 clientvm sshd[8489]: Failed password for myuser from REDACTED port 10320 ssh2 Aug 8 16:46:07 clientvm sshd[8489]: Connection closed by REDACTED port 10320 [preauth] In /var/log/sssd/sssd_mydomain.log: (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=myuser@mydomain] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sss_domain_get_state] (0x1000): Domain mydomain is Active (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x561aa191ac20 (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x561aa191ace0 (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): Running timer event 0x561aa191ac20 "ltdb_callback" (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): Destroying timer event 0x561aa191ace0 "ltdb_timeout" (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): Ending timer event 0x561aa191ac20 "ltdb_callback" (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_attach_req] (0x0400): DP Request [Initgroups #2]: New request. Flags [0x0001]. (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sss_domain_get_state] (0x1000): Domain mydomain is Active (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_initgr_send] (0x4000): Retrieving info for initgroups call (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [ou=people,ou=primary,ou=eid,dc=my,dc=edu] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_print_server] (0x2000): Searching REDACTED:636 (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=myuser)(objectclass=inetorgperson)(&(uid=*)(!(uid=0))))][ou=people,ou=primary,ou=eid,dc=my,dc=edu]. (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [homeDirectory] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPrincipalName] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [rhost] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sshPublicKey] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userCertificate;binary] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [mail] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 5 (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_op_add] (0x2000): New operation 5 timeout 6 (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_result] (0x2000): Trace: sh[0x561aa17fdf50], connected[1], ops[0x561aa191d380], ldap[0x561aa17dbd00] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_parse_entry] (0x1000): OriginalDN: [uid=myuser,ou=people,ou=primary,ou=eid,dc=my,dc=edu]. (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_parse_range] (0x2000): No sub-attributes for [mail] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_parse_range] (0x2000): No sub-attributes for [uid] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimestamp] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_result] (0x2000): Trace: sh[0x561aa17fdf50], connected[1], ops[0x561aa191d380], ldap[0x561aa17dbd00] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_op_destructor] (0x2000): Operation 5 finished (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_initgr_user] (0x4000): Receiving info for the user (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_initgr_user] (0x4000): Storing the user (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x0400): Save user (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_attrs_get_sid_str] (0x1000): No [objectSID] attribute. [0][Success] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x4000): objectSID: not available for user (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x4000): Failed to retrieve UUID [2][No such file or directory]. (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_primary_name] (0x0400): Processing object myuser (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x0400): Processing user myuser@mydomain (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x0020): Cannot retrieve UID for [myuser@mydomain] in domain [mydomain]. (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x0020): Failed to save user [myuser@mydomain] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0) (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_id_op_done] (0x4000): releasing operation connection (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_req_done] (0x0400): DP Request [Initgroups #2]: Request handler finished [0]: Success (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [_dp_req_recv] (0x0400): DP Request [Initgroups #2]: Receiving request data. (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_req_reply_list_success] (0x0400): DP Request [Initgroups #2]: Finished. Success. (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_req_reply_std] (0x1000): DP Request [Initgroups #2]: Returning [Internal Error]: 3,1432158246,Init group lookup failed (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:3::mydomain:name=myuser@mydomain] from reply table (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_req_destructor] (0x0400): DP Request [Initgroups #2]: Request removed. (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_result] (0x2000): Trace: sh[0x561aa17fdf50], connected[1], ops[(nil)], ldap[0x561aa17dbd00] (Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list in /var/log/sssd/sssd_pam.log: (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_cmd_authenticate] (0x0100): entering pam_cmd_authenticate (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'myuser' matched without domain, user is myuser (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): domain: not set (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): user: myuser (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): service: sshd (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): rhost: REDACTED (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): priv: 1 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 8489 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): logon name: myuser (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_initgr_check_timeout] (0x4000): User [myuser] not found in PAM cache. (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_set_plugin] (0x2000): CR #0: Setting "Initgroups by name" plugin (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_send] (0x0400): CR #0: New request 'Initgroups by name' (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_process_input] (0x0400): CR #0: Parsing input name [myuser] (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'myuser' matched without domain, user is myuser (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_set_name] (0x0400): CR #0: Setting name [myuser] (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_select_domains] (0x0400): CR #0: Performing a multi-domain search (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_domains] (0x0400): CR #0: Search will bypass the cache and check the data provider (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain mydomain type POSIX is valid (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_set_domain] (0x0400): CR #0: Using domain [mydomain] (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_prepare_domain_data] (0x0400): CR #0: Preparing input data for domain [mydomain] rules (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_send] (0x0400): CR #0: Looking up myuser@mydomain (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [myuser@mydomain] (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/mydomain/myuser@mydomain] (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_ncache] (0x0400): CR #0: [myuser@mydomain] is not present in negative cache (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_dp] (0x0400): CR #0: Looking up [myuser@mydomain] in data provider (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_dp_issue_request] (0x0400): Issuing request for [0x5624540cd550:3:myuser@mydomain@mydomain] (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request for [mydomain][0x3][BE_REQ_INITGROUPS][name=myuser@mydomain:-] (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x562454f181e0 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_dp_internal_get_send] (0x0400): Entering request [0x5624540cd550:3:myuser@mydomain@mydomain] (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x562454f181e0 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 0x562454f1bc40 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching. (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3 errno: 1432158246 error message: Init group lookup failed (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_common_dp_recv] (0x0040): CR #0: Data Provider Error: 3, 1432158246, Init group lookup failed (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_common_dp_recv] (0x0400): CR #0: Due to an error we will return cached data (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_cache] (0x0400): CR #0: Looking up [myuser@mydomain] in cache (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x562454f289b0 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x562454f28a70 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Running timer event 0x562454f289b0 "ltdb_callback" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x562454f28a70 "ltdb_timeout" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x562454f289b0 "ltdb_callback" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_cache] (0x0400): CR #0: Object [myuser@mydomain] was not found in cache (Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_process_result] (0x0400): CR #0: Finished: Not found (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x562454f1d530 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x562454f20ff0 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Running timer event 0x562454f1d530 "ltdb_callback" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x562454f20ff0 "ltdb_timeout" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x562454f1d530 "ltdb_callback" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [10]: User not known to the underlying authentication module. (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x562454f29580 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x562454f29640 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Running timer event 0x562454f29580 "ltdb_callback" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x562454f29640 "ltdb_timeout" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x562454f29580 "ltdb_callback" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x562454f248b0 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x562454f23ec0 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Running timer event 0x562454f248b0 "ltdb_callback" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x562454f23ec0 "ltdb_timeout" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x562454f248b0 "ltdb_callback" (Thu Aug 8 16:45:53 2019) [sssd[pam]] [filter_responses] (0x0100): [pam_response_filter] not available, not fatal. (Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_reply] (0x0200): blen: 8 (Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x5624540cd550:3:myuser@mydomain@mydomain] (Thu Aug 8 16:46:07 2019) [sssd[pam]] [client_recv] (0x0200): Client disconnected! (Thu Aug 8 16:46:07 2019) [sssd[pam]] [client_close_fn] (0x2000): Terminated client [0x562454f245a0][19] Thanks, Jane

4 8

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users August 2019