On 4/2/2013 2:42 AM, Jakub Hrozek wrote:
On Fri, Mar 29, 2013 at 12:11:09PM -0700, Wes Modes wrote:
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_ldap_connect_callback_add]
(0x1000): New LDAP connection to [ldap://ldap.mydomain.com:389/??base] with fd [21].
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_sys_connect_done] (0x0100):
Executing START TLS
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_process_result] (0x2000):
Trace: sh[0x16527c0], connected[1], ops[0x1657410], ldap[0x1659e90]
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_process_message] (0x4000):
Message type: [LDAP_RES_EXTENDED]
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_connect_done] (0x0080): START
TLS result: Success(0), (null)
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_connect_done] (0x0080):
ldap_install_tls failed: [Connect error] [TLS error -8172:Peer's certificate issuer
has been marked as not trusted by the user.]
Here is your problem. While SSSD allows the use of anonymous bind for
retrieving identity information, authentication must be performed over
secure channel. The default (unless the URI starts with ldaps://) is
TLS.
See options ldap_tls_cacert, ldap_tls_cacertdir etc in man sssd-ldap.
Oh no, that's bad news for me, as I never could get TLS working on my
OpenLDAP server!
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [sdap_handle_release] (0x2000):
Trace: sh[0x16527c0], connected[1], ops[(nil)], ldap[0x1659e90], destructor_lock[0],
release_memory[0]
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [remove_connection_callback]
(0x4000): Successfully removed connection callback.
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [fo_set_port_status] (0x0100):
Marking port 389 of server 'ldap.mydomain.com' as 'not working'
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [fo_resolve_service_send] (0x0100):
Trying to resolve service 'LDAP'
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [get_server_status] (0x1000):
Status of server 'ldap.mydomain.com' is 'working'
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [get_port_status] (0x1000): Port
status of port 389 for server 'ldap.mydomain.com' is 'not working'
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [get_server_status] (0x1000):
Status of server 'ldap.mydomain.com' is 'working'
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [get_port_status] (0x1000): Port
status of port 389 for server 'ldap.mydomain.com' is 'not working'
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [fo_resolve_service_send] (0x0020):
No available servers for service 'LDAP'
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [be_resolve_server_done] (0x1000):
Server resolution failed: 5
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [be_mark_offline] (0x2000): Going
offline!
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [be_run_offline_cb] (0x0080): Going
offline. Running callbacks.
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [be_pam_handler_callback] (0x0100):
Backend returned: (1, 9, <NULL>) [Provider is Offline (Authentication service cannot
retrieve authentication info)]
> (Fri Mar 29 12:03:26 2013) [sssd[be[default]]] [be_pam_handler_callback] (0x0100):
Sending result [9][default]
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
--
Wes Modes
Systems Designer, Developer, and Administrator
University Library ITS
University of California, Santa Cruz