Hi All,

I'm using sssd to authenticate users from AD and generally this works fine. However, I have one server that frequently can't resolve AD users: [root@HOST ~]# id aduser@domain.com id: aduser@domain.com: no such user

or:

[aduser@HOST ~]# crontab -l crontab: your UID isn't in the passwd file. bailing out.

Around that time I see errors like this in the log: [sssd[be[domain.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Referral(10), 0000202B: RefErr: DSID-03100781, data 0, 1 access points ref 1: 'Domain.com'

After a view minutes it works again.

What puzzles me is that I have 2 other servers with the same config using that same user which don't have any problem.

I'm running sssd- 1.16.4. 21.el7_7.1 on CentOS Linux release 7.7.1908 (Core) This is my sssd.conf:

[sssd] debug_level=9 sbus_timeout = 30 reconnection_retries = 3 services = nss, pam config_file_version = 2 domains = domain.com

[pam] debug_level=9 pam_verbosity = 3 reconnection_retries = 3

[nss] debug_level=9 reconnection_retries = 3

[domain/domain.com] debug_level=9 ad_site = SITE use_fully_qualified_names = true override_homedir = /home/%u dyndns_update = false ldap_schema = ad id_provider = ad ad_enabled_domains = sub.domain.com, domain.com ad_gpo_access_control = disabled case_sensitive = true cache_credentials = true min_id = 1000 ldap_id_mapping = False ldap_group_nesting_level = 4 ldap_user_primary_group = gidNumber ad_hostname = host.domain.com ignore_group_members = TRUE access_provider = simple simple_allow_groups = group1@domain.com,group2@sub.domain.com,group3@sub.domain.com

Thank you, Christoph

DISCLAIMER The content of this email and any files transmitted with it may be confidential and intended solely for the use of the individual named. If you have received this email in error please let us know and delete the content from your system. You may NOT copy or disclose the information to anyone. We do not accept any liability if this email is used for an alternative purpose from which it is intended, nor to any third party in respect thereof. The sender does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission.

Unless we have agreed otherwise in writing, Sony DADC’s Standard Terms and Conditions of Business will apply to any services and-or disc/home-entertainment related products we provide to you, our Consumer Sales General Conditions will apply to any consumer electronics products we supply to you and our General Conditions of Purchase will apply to any goods and/or services we purchase from you.