On Fri, Mar 29, 2013 at 12:11:09PM -0700, Wes Modes wrote:
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldap://ldap.mydomain.com:389/??base] with fd [21].
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_sys_connect_done] (0x0100):
Executing START TLS
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace:
sh[0x16527c0], connected[1], ops[0x1657410], ldap[0x1659e90]
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_process_message] (0x4000):
Message type: [LDAP_RES_EXTENDED]
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_connect_done] (0x0080): START TLS
result: Success(0), (null)
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_connect_done] (0x0080):
ldap_install_tls failed: [Connect error] [TLS error -8172:Peer's certificate issuer
has been marked as not trusted by the user.]
Here is your problem. While SSSD allows the use of anonymous bind for
retrieving identity information, authentication must be performed over
secure channel. The default (unless the URI starts with ldaps://) is
TLS.
See options ldap_tls_cacert, ldap_tls_cacertdir etc in man sssd-ldap.
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]]
[sdap_handle_release] (0x2000): Trace: sh[0x16527c0], connected[1], ops[(nil)],
ldap[0x1659e90], destructor_lock[0], release_memory[0]
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [remove_connection_callback] (0x4000):
Successfully removed connection callback.
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [fo_set_port_status] (0x0100): Marking
port 389 of server 'ldap.mydomain.com' as 'not working'
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [fo_resolve_service_send] (0x0100):
Trying to resolve service 'LDAP'
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [get_server_status] (0x1000): Status of
server 'ldap.mydomain.com' is 'working'
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [get_port_status] (0x1000): Port status
of port 389 for server 'ldap.mydomain.com' is 'not working'
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [get_server_status] (0x1000): Status of
server 'ldap.mydomain.com' is 'working'
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [get_port_status] (0x1000): Port status
of port 389 for server 'ldap.mydomain.com' is 'not working'
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [fo_resolve_service_send] (0x0020): No
available servers for service 'LDAP'
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [be_resolve_server_done] (0x1000):
Server resolution failed: 5
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [be_mark_offline] (0x2000): Going
offline!
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [be_run_offline_cb] (0x0080): Going
offline. Running callbacks.
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [be_pam_handler_callback] (0x0100):
Backend returned: (1, 9, <NULL>) [Provider is Offline (Authentication service cannot
retrieve authentication info)]
(Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [be_pam_handler_callback] (0x0100):
Sending result [9][default]