Hello,
I am trying to use sssd to authenticate against an Active
Directory server. As far as I can tell (verified using Wireshark when sssd
tries to enumerate the domain), LDAP binds are working just fine over SASL,
and Kerberos is more-or-less happy, but whenever I do getent -s sss passwd,
nothing is returned. Wireshark shows no attempts to communicate with, well,
anything. There are no reports in the sssd_domain log or sssd_nss log. When
I attempt to log in via ssh using a username that doesn't exist locally, I
see the following in /var/log/secure:
sshd[1381]: Invalid user bob from
127.0.0.1
sshd[1382]: input_userauth_request: invalid user bob
sshd[1381]:
pam_unix(sshd:auth): check pass; user unknown
sshd[1381]:
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
ruser=
rhost=client.domain.net
sshd[1381]: pam_succeed_if(sshd:auth): error
retrieving information about user bob
sshd[1381]: Failed password for
invalid user bob from 127.0.0.1 port 56849 ssh2
sshd[1382]: Connection
closed by 127.0.0.1
I also see a Kerberos AS-REQ for
krbtgt/DOMAIN.NET
(which is odd because the cache contains krbtgt/DOMAIN.NET(a)DOMAIN.NET and
ldap/dc.domain.net(a)DOMAIN.NET already), which is rejected with a KRB-ERR
claiming principal not found.
Finally, I occasionally (not sure exactly
when, but it seems to be when I try to log in with users that DO exist
locally) see the following in /var/log/secure:
pam_sss(sshd:session):
Request to sssd failed. Connection refused
sssd IS running.
This is all
running on a Centos 6.3 machine using sssd 1.9.3, built from source. The
1.8.0 that ships with Centos was installed originally but has since been
removed. All other packages are Centos latest, so probably at least a year
out of date.
Are there any suggestions for debugging? It almost seems
like nss is not even bothing to ask sssd for credentials, or like sssd is
rejecting said requests silently, or that dbus is failing to send the
messages, or.. something. Though I do see pings for both nss and pam in the
sssd logs, so the dbus explanation seems unlikely.
Thank you for your
time.