Hi Devs,
I am seeing an issue with sssd-1.8.0-32.el6.x86_64
Issue description.
When system is on a different VLAN as the Active directory servers
logins are really slow or timeout and I see these errors.
I see this in the syslog
Aug 13 10:27:32 m4deploy01 sssd_be: GSSAPI Error: An invalid name was
supplied (Unknown error)
I see this in the sssd log
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_parse_entry] (0x4000): OriginalDN: [CN=Derek
Page,OU=Concord,DC=my,DC=domain,DC=com].
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
ops[0x2194c10], ldap[0x31ae7b0]
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[
ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com]
with fd [35].
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[
ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com]
with fd [36].
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[
ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com] with fd
[37].
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
(-2)[Local error]
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_rebind_proc] (0x1000): Failed to bind to
[
ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com].
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
with fd [37].
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
(-2)[Local error]
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_rebind_proc] (0x1000): Failed to bind to
[
ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com].
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
with fd [36].
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
(-2)[Local error]
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_rebind_proc] (0x1000): Failed to bind to
[
ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com].
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
with fd [35].
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_process_message] (0x4000): Message type:
[LDAP_RES_SEARCH_REFERENCE]
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
ops[0x2194c10], ldap[0x31ae7b0]
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_process_message] (0x4000): Message type:
[LDAP_RES_SEARCH_REFERENCE]
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
ops[0x2194c10], ldap[0x31ae7b0]
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_process_message] (0x4000): Message type:
[LDAP_RES_SEARCH_REFERENCE]
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
ops[0x2194c10], ldap[0x31ae7b0]
(Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
[sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Mon Aug 13 10:30:09 2012) [sssd[be[my.domain.com]]] [sbus_dispatch]
(0x4000): dbus conn: 2163580
If I moved the system to the same VLAN as the Active Directory servers
and these errors go away and everything works great.
Other systems running sssd-1.5.1-49.el5_8.1 on a different VLAN then
my Active Directory servers also work great.
Is this an issue with 1.8.0-32?
Any suggestions?
Here are my configs.
#/etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm =
MYDOMAIN.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
default_tgs_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
default_tkt_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
permitted_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
[realms]
MY.DOMAIN.COM = {
kdc = ad.my.domain.com:88
admin_server =
ad.my.domain.com
default_domain =
my.domain.com
}
[domain_realm]
.my.domain.com =
MY.DOMAIN.COM
my.domain.com =
MY.DOMAIN.COM
#/etc/sssd/sssd.conf
[domain/default]
cache_credentials = fasle
[sssd]
config_file_version = 2
domains =
my.domain.com
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
[
domain/my.domain.com]
cache_credentials = false
enumerate = false
min_id = 80
max_id = 30000
id_provider = ldap
auth_provider = krb5
ldap_uri =
ldap://ad3.my.domain.com/
ldap_schema = rfc2307bis
ldap_user_search_base = dc=my,dc=domain,dc=com
ldap_user_object_class = person
ldap_user_modify_timestamp = whenChanged
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_user_principal = userPrincipalName
ldap_group_search_base = dc=my,dc=domain,dc=com
ldap_group_object_class = group
ldap_group_modify_timestamp = whenChanged
ldap_group_nesting_level = 5
ldap_account_expire_policy = ad
ldap_sasl_authid = M4DEPLOY01$(a)MY.DOMAIN.COM
ldap_krb5_init_creds = true
ldap_pwd_policy = mit_kerberos
chpass_provider = krb5
ldap_sasl_mech = GSSAPI
krb5_realm =
MY.DOMAIN.COM
krb5_validate = true
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_user_principal = userPrincipalName
ldap_group_object_class = group
ldap_group_name = sAMAccountName
ldap_group_gid_number = gidNumber
ldap_force_upper_case_realm = true
#ldap_referrals = false
# User Group and Account Access
access_provider = simple
#simple_allow_users =
simple_allow_groups = m4_login
debug_level = 10