I'm trying to configure sssd 1.8.4 on a Debian Sid server to use a
LDAP+Kerberos domain, and I'm getting this error in sssd debug log:
[sdap_process_result] (0x0040): ldap_result error: [Success]
More context:
[sssd[be[nullroute]]] [set_server_common_status] (0x0100): Marking
server 'radian.cluenet.org' as 'name resolved'
[sssd[be[nullroute]]] [be_resolve_server_done] (0x1000): Saving the first resolved
server
[sssd[be[nullroute]]] [be_resolve_server_done] (0x0200): Found address for server
radian.cluenet.org: [70.85.16.91] TTL 10467
[sssd[be[nullroute]]] [sdap_uri_callback] (0x0400): Constructed uri
'ldap://radian.cluenet.org'
[sssd[be[nullroute]]] [sss_ldap_init_send] (0x0400): Setting 6 seconds timeout for
connecting
[sssd[be[nullroute]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldap://radian.cluenet.org:389/??base] with fd [19].
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=*)][].
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [*]
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[altServer]
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[namingContexts]
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[supportedControl]
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[supportedExtension]
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[supportedFeatures]
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[supportedLDAPVersion]
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[supportedSASLMechanisms]
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[defaultNamingContext]
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [lastUSN]
[sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[highestCommittedUSN]
[sssd[be[nullroute]]] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no
errmsg set
[sssd[be[nullroute]]] [sdap_get_server_opts_from_rootdse] (0x0200): No known USN scheme
is supported by this server!
[sssd[be[nullroute]]] [sdap_get_server_opts_from_rootdse] (0x0200): Will use modification
timestamp as usn!
[sssd[be[nullroute]]] [simple_bind_send] (0x0100): Executing simple bind as: (null)
[sssd[be[nullroute]]] [sdap_process_result] (0x0040): ldap_result error: [Success]
[sssd[be[nullroute]]] [fo_set_port_status] (0x0100): Marking port 389 of server
'radian.cluenet.org' as 'not working'
[sssd[be[nullroute]]] [fo_resolve_service_send] (0x0100): Trying to resolve service
'LDAP'
[sssd[be[nullroute]]] [get_server_status] (0x1000): Status of server
'radian.cluenet.org' is 'name resolved'
[sssd[be[nullroute]]] [get_port_status] (0x1000): Port status of port 389 for server
'radian.cluenet.org' is 'not working'
[sssd[be[nullroute]]] [fo_resolve_service_send] (0x0020): No available servers for
service 'LDAP'
[sssd[be[nullroute]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5
[sssd[be[nullroute]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going
offline (5 [Input/output error])
In other words, it seems to be able to connect, but considers "Success"
to be an error...
The configuration for the domain is simple, and works on Arch Linux:
[domain/nullroute]
enumerate = false
dns_discovery_domain =
nullroute.eu.org
id_provider = ldap
auth_provider = krb5
ldap_uri = _srv_,
ldap://radian.cluenet.org
ldap_search_base = dc=nullroute,dc=eu,dc=org
krb5_realm =
NULLROUTE.EU.ORG
I'd appreciate any help.
--
Mantas Mikulėnas