On Fri, Aug 23, 2019 at 01:07:23PM +0200, Ronald Wimmer via FreeIPA-users wrote:
On 22.08.19 15:57, Jakub Hrozek via FreeIPA-users wrote:
> [...]
> As far as I remember, Keycloak uses the D-Bus interface of SSSD to
> retrieve the user's attribute. Can you check if the ifp service is up
> and running and if there are any helpful logs in the sssd_ifp.log file?
I do not get AD attributes apart from mail:
(Tue Aug 20 14:09:37 2019) [sssd[ifp]] [ifp_add_ldb_el_to_dict] (0x0400):
element [mail] has value [Ronald.Wimmer(a)mydomain.at]
(Tue Aug 20 14:09:37 2019) [sssd[ifp]] [ifp_user_get_attr_handle_reply]
(0x0080): Attribute givenname not present or has no values
(Tue Aug 20 14:09:37 2019) [sssd[ifp]] [ifp_user_get_attr_handle_reply]
(0x0080): Attribute sn not present or has no values
(Tue Aug 20 14:09:37 2019) [sssd[ifp]] [ifp_user_get_attr_handle_reply]
(0x0080): Attribute telephoneNumber not present or has no values
(Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_dispatch] (0x4000): dbus conn:
0x55a8f4758970 (Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_dispatch]
(0x4000): Dispatching. (Tue Aug 20 14:10:05 2019) [sssd[ifp]]
[sbus_signal_handler] (0x2000): Received D-Bus signal
org.freedesktop.DBus.NameOwnerChanged (Tue Aug 20 14:10:05 2019) [sssd[ifp]]
[sbus_signal_handler_got_caller_id] (0x0400): Got a signal from the bus..
(Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_signal_name_owner_changed]
(0x0400): Clearing UIDs cache (Tue Aug 20 14:10:05 2019) [sssd[ifp]]
[sbus_dispatch] (0x4000): dbus conn: 0x55a8f4758970 (Tue Aug 20 14:10:05
2019) [sssd[ifp]] [sbus_dispatch] (0x4000): Dispatching. (Tue Aug 20
14:10:05 2019) [sssd[ifp]] [sbus_signal_handler] (0x2000): Received D-Bus
signal org.freedesktop.DBus.NameOwnerChanged (Tue Aug 20 14:10:05 2019)
[sssd[ifp]] [sbus_signal_handler_got_caller_id] (0x0400): Got a signal from
the bus.. (Tue Aug 20 14:10:05 2019) [sssd[ifp]]
[sbus_signal_name_owner_changed] (0x0400): Clearing UIDs cache
And here a keycloak log snippet:
Aug 20 13:10:46 keycloak-test.linux.mydomain.at standalone.sh[16537]:
13:10:46,967 WARNÂ [org.keycloak.services] (default task-52)
KC-SERVICES0013: Failed authentication: org.keycloak
.federation.sssd.api.SSSDException: Failed to retrieve user's attributes.
Check if SSSD service is active.
Aug 20 13:10:46 keycloak-test.linux.mydomain.at standalone.sh[16537]: at
org.keycloak.federation.sssd.api.Sssd.getUser(Sssd.java:112)
Aug 20 13:10:46 keycloak-test.linux.mydomain.at standalone.sh[16537]: at
org.keycloak.federation.sssd.SSSDFederationProvider.importUserToKeycloak(SSSDFederationProvider.java:114)
Aug 20 13:10:46 keycloak-test.linux.mydomain.at standalone.sh[16537]: at
org.keycloak.federation.sssd.SSSDFederationProvider.findOrCreateAuthenticatedUser(SSSDFederationProvider.java:
109)
Hmm, I don't remember from the top of my head which attributes does KC
try to fetch, but e-mail sounds like what it would need, at least that's
what's most commonly used for claims and such.
If you correlate the KC lookup errors with ifp sssd logs, what is the
exact lookup that KC is doing but that is failing?