Hello. We are building a kickstart profile so that we can begin using RHEL 6 in our environment. However, we have run into a problem with sssd and ldaps. It seems that in RHEL 6 nss_ldap has been depreciated and replaced with sssd. I have been able to configure sssd for regular ldap without problem. When I attempt to enable ldaps by changing the ldap uri to ldaps:// authentication no longer functions. However, id and getent functionality remains. Debug level was changed to 10 and here is what I see in the logs for sssd.

(Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [simple_bind_send] (4): Executing simple bind as: uid=testuser,ou=people,dc=mydomain,dc=com
(Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2
(Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: sh[0x1994860], connected[1], ops[0x1a5dde0], ldap[0x16d2fc0]
(Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [sdap_process_result] (4): ldap_result gave -1, something bad happend!
(Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [sdap_handle_release] (8): Trace: sh[0x1994860], connected[1], ops[0x1a5dde0], ldap[0x16d2fc0], destructor_lock[0], release_memory[0]
(Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [remove_connection_callback] (9): Successfully removed connection callback.

Unfortunately, "Something bad happend!" isn't quite specific enough to track down the problem.

Below is other pertinent information for this case.

SSSD version: sssd-1.2.1-28.el6.x86_64
SSSD.conf:
[sssd]
config_file_version = 2

reconnection_retries = 3

sbus_timeout = 30
services = nss, pam

domains = default
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3

[pam]
reconnection_retries = 3

[domain/default]
ldap_tls_reqcert = demand
auth_provider = ldap
cache_credentials = False
ldap_id_use_start_tls = False
debug_level = 20
enumerate = True
ldap_schema = rfc2307
ldap_group_search_base = ou=posixGroups,dc=mydomain,dc=com
ldap_user_search_base = ou=People,dc=mydomain,dc=com
ldap_default_authtok_type = password
ldap_search_base = dc=mydomain,dc=com
chpass_provider = ldap
id_provider = ldap
ldap_default_bind_dn = uid=binduser,ou=Special Users,dc=mydomain,dc=com
ldap_uri = ldaps://ldap.mydomain.com/
ldap_default_authtok = XXXXXXXXXXX
ldap_tls_cacertdir = /etc/ssl/certs

Please let me know if there is other information that you need.

Thank you very much for any help you can provide. Ive been trying to track down this problem for three days.

Brandon