Hi, We're getting this referral related error in our sssd installation. Some environment information: * CentOS 6.6 clients, sssd v1.11.6 * Windows 2012R2 domain controllers, 2008R2 functional level, single domain forest. Let's call it ad.example.com. * We have one-way trusts to several other domains/forests, a.foo,com, b.bar.com and c.baz.com

We've joined the clients with adcli, and we can successfully authenticate with accounts from the ad.example.com domain. It is also possible to kinit myuser@A.FOO.COM

but this fails: getent passwd myuser@a.foo.com

Looking at the logs (after setting debug_level=8), I can see this error message:

(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_process_result] (0x2000): Trace: sh[0xda3140], connected[1], ops[0xda1480], ldap[0xda3720] (Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0400): Search result: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points ref 1: 'a.foo.com'

(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points ref 1: 'a.foo.com'

(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [5]: Input/output error (Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_users_done] (0x0040): Failed to retrieve users

(There's also a row slightly after, "[ad_account_info_complete] (0x0010): Bug: dp_error is OK on failed request", unclear if this is related, or actually a separate bug)

I first interpreted this as indicating that I needed to allow referral chasing, but when I turn that on (via ldap_referrals = true), but aside from taking much longer, it still errors:

(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_process_result] (0x2000): Trace: sh[0xe4b9b0], connected[1], ops[0xe4c540], ldap[0xe50a40] (Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://a.foo.com/dc=a,dc=foo,dc=com] with fd [25]. (Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://a.foo.com/dc=a,dc=foo,dc=com]. (Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0400): Search result: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points ref 1: 'a.foo.com'

(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points ref 1: 'a.foo.com'

(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [5]: Input/output error (Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_users_done] (0x0040): Failed to retrieve users

I also suspected networking issues a while, but a Windows client on the same subnet can authenticate fine (we only do subnet filtering in our firewalls).

Here are my configuration files: sssd.conf: [sssd] services = nss, pam, ssh, autofs config_file_version = 2 domains = AD.EXAMPLE.COM

[nss] override_homedir = /home/%d/%u override_shell = /bin/bash

[domain/AD.EXAMPLE.COM] debug_level = 8 id_provider = ad use_fully_qualified_names = TRUE

krb5.conf: [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log

[libdefaults] default_realm = AD.EXAMPLE.COM dns_lookup_realm = true dns_lookup_kdc = true ticket_lifetime = 24h renew_lifetime = 7d forwardable = true

# I found documentation indicating that these should be commented out while troubleshooting # Commenting in/out does not seem to affect the problem, however. [realms] # AD.EXAMPLE.COM = { # kdc = ad102.ad.example.com # kdc = ad201.ad.example.com # admin_server = ad201.ad.example.com # }

[domain_realm] # .ad.example.com = AD.EXAMPLE.COM # ad.example.com = AD.EXAMPLE.COM

What have we done wrong?

Best regards, Carl