On 10/10/2012 10:48 AM, Aziz Sasmaz wrote:
Yes

On Wed, Oct 10, 2012 at 3:24 PM, Jakub Hrozek <jhrozek@redhat.com> wrote:
On Wed, Oct 10, 2012 at 02:42:03PM +0300, Aziz Sasmaz wrote:
> On Wed, Oct 10, 2012 at 11:37 AM, Jakub Hrozek <jhrozek@redhat.com> wrote:
>
> > On Wed, Oct 10, 2012 at 10:34:46AM +0300, Aziz Sasmaz wrote:
> > > Hi,
> > >
> > > I use sssd on all servers in our infrastruceture.  Most of them Redhat,
> > > Centos and debian. It works very well with these OSes.
> > >  And we have some gentoo linux machines.  I had  some difficulties
> > > configuring sssd when I want to use ldaps
> > >
> > > [domain/LDAP]
> > > id_provider = ldap
> > > auth_provider = ldap
> > > chpass_provider = ldap
> > > ldap_schema = rfc2307
> > > ldap_uri = ldaps://ldap.xxx.com
> > > ldap_chpass_uri = ldaps://ldap-provider.xxx.com
> > > ldap_search_base = dc=xxx,dc=com
> > > ldap_tls_reqcert = allow
> > > cache_credentials = true
> > > enumerate = true
> > > entry_cache_timeout = 5400
> > > ldap_user_gecos = uid
> > >
> > > When I use ldap_uri = ldap   or  ldap_uri = ldaps  getent works, but
> > logins
> > > are not working. There are interesting entries in log files;
> > >
> > > sssd_LDAP
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_new_service] (0x0080):
> > > Creating new service 'LDAP'
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_add_server] (0x0080):
> > > Adding new server 'ldap.xxx.com', to service 'LDAP'
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_new_service] (0x0080):
> > > Creating new service 'LDAP_CHPASS'
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_add_server] (0x0080):
> > > Adding new server 'ldap-provider.xxx.com', to service 'LDAP_CHPASS'
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [sssm_ldap_sudo_init]
> > (0x0080):
> > > Sudo init handler called but SSSD is built without sudo support, ignoring
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [sssm_ldap_autofs_init]
> > > (0x0080): Autofs init handler called but SSSD is built without autofs
> > > support, ignoring
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [be_process_init] (0x0020):
> > No
> > > Session module provided for [LDAP] !!
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [be_process_init] (0x0020):
> > No
> > > host info module provided for [LDAP] !!
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [main] (0x0020): Backend
> > > provider (LDAP) started!
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]] [sdap_sys_connect_done]
> > > (0x0080): Failed to set LDAP SASL nocanon option to true. If your system
> > is
> > > configured to use SASL, LDAP operations might fail.
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]] [simple_bind_done] (0x0080):
> > > Bind result: Success(0), no errmsg set
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]] [sdap_process_group_send]
> > > (0x0040): No Members. Done!
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]] [sdap_process_group_send]
> > > (0x0040): No Members. Done!
> > >
> > > sssd_nss
> > > (Wed Oct 10 09:58:24 2012) [sssd[nss]] [nss_dp_reconnect_init] (0x0010):
> > > Could not reconnect to LDAP provider.
> > > (Wed Oct 10 09:58:54 2012) [sssd[nss]] [sbus_reconnect] (0x0080): Making
> > > reconnection attempt 8 to
> > > [unix:path=/var/lib/sss/pipes/private/sbus-dp_LDAP]
> > > (Wed Oct 10 09:58:54 2012) [sssd[nss]] [sbus_reconnect] (0x0020): Failed
> > to
> > > open connection: name=org.freedesktop.DBus.Error.NoServer, message=Failed
> > > to connect to socket /var/lib/sss/pipes/private/sbus-dp_LDAP: Connection
> > > refused
> > >
> > > sssd_pam
> > > (Wed Oct 10 09:59:24 2012) [sssd[pam]] [pam_dp_reconnect_init] (0x0010):
> > > Could not reconnect to LDAP provider.
> > > (Wed Oct 10 09:59:54 2012) [sssd[pam]] [sbus_reconnect] (0x0080): Making
> > > reconnection attempt 10 to
> > > [unix:path=/var/lib/sss/pipes/private/sbus-dp_LDAP]
> > > (Wed Oct 10 09:59:54 2012) [sssd[pam]] [sbus_reconnect] (0x0020): Failed
> > to
> > > open connection: name=org.freedesktop.DBus.Error.NoServer, message=Failed
> > > to connect to socket /var/lib/sss/pipes/private/sbus-dp_LDAP: Connection
> > > refused
> > >
> > > It says  connection refused but there is no network issue with ldap
> > > servers, all ports opened. Could you pleasegive me advice resolving this
> > > issue?
> > >
> > > Thanks,
> > >
> > > AS
> >
> > Hi,
> >
> > the Connection Refused message does not describe a connection to the
> > server but rather connection via unix sockets between different parts of
> > the SSSD. Can you check the following for me?
> >
> > 1) ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP
> > It should be a symlink pointing to
> > /var/lib/sss/pipes/private/sbus-dp_LDAP.$PID where $PID should
> > correspond to the PID number of the sssd_be process.
> >
> > 2) Does restart of the SSSD clear things up?
> >
> > 3) If not, can you paste or attache the DEBUG messages that the SSSD
> > prints after startup?
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel@lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >
>
>
> Yes there is symbolic link for that.
>
> root@admin01 ~#  ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP
> lrwxrwxrwx 1 root root 45 2012-10-10 10:29
> /var/lib/sss/pipes/private/sbus-dp_LDAP ->
> /var/lib/sss/pipes/private/sbus-dp_LDAP.31432
>

is 31432 a PID of your sssd_be process? If you issue:
ps -axu | grep sssd_be
there should be a sssd_be process running with parameter --domain LDAP.

Is there anything interesting in /var/log/sssd_LDAP.log ?
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

Hi,

Yes it'is the same number as pid. As you can see;

root@admin01 ~# ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP
lrwxrwxrwx 1 root root 45 2012-10-10 14:54 /var/lib/sss/pipes/private/sbus-dp_LDAP -> /var/lib/sss/pipes/private/sbus-dp_LDAP.32375

root@admin01 ~# ps -fe |grep sssd_be
root     32375 32374  0 14:54 ?        00:00:05 /usr/libexec/sssd/sssd_be --domain LDAP -d 0x00f0 --debug-to-files

sssd_LDAP.log  is below;

(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_new_service] (0x0080): Creating new service 'LDAP'
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_add_server] (0x0080): Adding new server 'ldap.bilyoner.com', to service 'LDAP'
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_new_service] (0x0080): Creating new service 'LDAP_CHPASS'
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_add_server] (0x0080): Adding new server 'ldap-provider.bilyoner.com', to service 'LDAP_CHPASS'
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [sssm_ldap_sudo_init] (0x0080): Sudo init handler called but SSSD is built without sudo support, ignoring
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [sssm_ldap_autofs_init] (0x0080): Autofs init handler called but SSSD is built without autofs support, ignoring
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [be_process_init] (0x0020): No Session module provided for [LDAP] !!
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [be_process_init] (0x0020): No host info module provided for [LDAP] !!
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [main] (0x0020): Backend provider (LDAP) started!
(Wed Oct 10 14:53:45 2012) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0080): Failed to set LDAP SASL nocanon option to true. If your system is configured to use SASL, LDAP operations might fail.


Can it be that underlying ldap library does not support SASL bind or the option that we are trying to set?




_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/