On 04/19/2013 05:51 PM, Jakub Hrozek wrote:
> On Fri, Apr 19, 2013 at 04:48:15PM +0200, steve wrote:
>> Hi
>> The LDAP_PROTOCOL_ERROR occurs once during user authentication and
>> again upon logging out. It does not occur with getent or at ny other
>> time during the session. I'm almost certain that this has something
>> to do with sssd; users authenticating against nslcd or winbind do
>> not produce this response from the Samba4 ldap. I'll post over on
>> samba-technical to see if they can help.
>> Cheers,
>> Steve
> Yes, but can you post the relevent snippet from the logs? They should
> include the query that is failing.
Hi
I put the level 9 logs here:
https://dl.dropboxusercontent.com/u/45150875/sssd.client.log.tar
I'm not a dev but I'll try: Here is where it fails getting the groups
for the user (from sssd_default.log) I think that this is what
produces the LDAP_PROTOCOL_ERROR.
(0x4000): Process user's groups
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_initgr_rfc2307bis_next_base] (0x0400): Searching for parent
groups for user [CN=steve3,CN=Users,DC=dolores,DC=site] with base
[dc=dolores,dc=site]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(member=CN=steve3,CN=Users,DC=dolores,DC=site)(objectclass=group)(cn=*))][dc=dolores,dc=site].
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsUniqueId]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 23
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x893d088], connected[1], ops[0x895ef58],
ldap[0x8933328]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: ldap_result found nothing!
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x893d088], connected[1], ops[0x895ef58],
ldap[0x8933328]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldap://dolores.site/CN=Configuration,DC=dolores,DC=site] with fd [22].
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_rebind_proc]
(0x1000): Successfully bind to
[ldap://dolores.site/CN=Configuration,DC=dolores,DC=site].
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_message]
(0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x893d088], connected[1], ops[0x895ef58],
ldap[0x8933328]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_message]
(0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x893d088], connected[1], ops[0x895ef58],
ldap[0x8933328]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_message]
(0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x893d088], connected[1], ops[0x895ef58],
ldap[0x8933328]
(Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result]
(0x0040): ldap_result error: [Can't contact LDAP server]
Hi. Not sure I've got the right ldapsearch syntax, but the filter from
sssd gives an error:
sudo ldapsearch -h doloresdc.dolores.site -b 'dc=dolores,dc=site'
'[(&(member=CN=steve3,CN=Users,DC=dolores,DC=site)(objectclass=group)(cn=*))][dc=dolores,dc=site]'
-Y GSSAPI
SASL/GSSAPI authentication started
SASL username: Administrator(a)DOLORES.SITE
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=dolores,dc=site> with scope subtree
# filter:
[(&(member=CN=steve3,CN=Users,DC=dolores,DC=site)(objectclass=group)(cn=*))][dc=dolores,dc=site]
# requesting: ALL
#
ldap_search_ext: Bad search filter (-7)