URL:
https://github.com/SSSD/sssd/pull/905
Title: #905: Don't ignore host entries in Group Policy security filters
pbrezina commented:
"""
Sorry for the delay I was on PTO. I will be much more responsive now so we can finally
finish it.
It does not crash anymore, though it is unable to retrieve host SID:
```
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_step] (0x0400): calling
ldap_search_ext with
[(&(name=master.client.vm)(objectClass=computer))][dc=ad,dc=vm].
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [objectSid]
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_step] (0x2000):
ldap_search_ext called, msgid = 16
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_op_add] (0x2000): New operation 16
timeout 6
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace:
sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510]
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace: end of
ldap_result list
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace:
sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510]
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_add_references]
(0x1000): Additional References: ldap://child.ad.vm/DC=child,DC=ad,DC=vm
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace:
sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510]
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_add_references]
(0x1000): Additional References:
ldap://ForestDnsZones.ad.vm/DC=ForestDnsZones,DC=ad,DC=vm
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace:
sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510]
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_add_references]
(0x1000): Additional References:
ldap://DomainDnsZones.ad.vm/DC=DomainDnsZones,DC=ad,DC=vm
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace:
sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510]
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_add_references]
(0x1000): Additional References: ldap://ad.vm/CN=Configuration,DC=ad,DC=vm
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace:
sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510]
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_op_finished] (0x0400):
Search result: Success(0), no errmsg set
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_op_destructor] (0x2000): Operation 16
finished
(Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [ad_gpo_get_host_sid_retrieval_done]
(0x0040): sdap_get_generic_recv failed to receive host sid
```
Probably because the computure object has `name=MASTER` instead of
`name=master.client.vm`. However this is after fresh enrollment to AD via `realm` command
so we need to be looking for the correct name here. Perhaps we can do base search on
`state->target_dn` which is `target_dn = 0x219dc70
"CN=MASTER,CN=Computers,DC=ad,DC=vm"`.
I wonder why did this search work for you?
"""
See the full comment at
https://github.com/SSSD/sssd/pull/905#issuecomment-572490512