Yes

On Wed, Oct 10, 2012 at 3:24 PM, Jakub Hrozek <jhrozek@redhat.com> wrote:
On Wed, Oct 10, 2012 at 02:42:03PM +0300, Aziz Sasmaz wrote:
> On Wed, Oct 10, 2012 at 11:37 AM, Jakub Hrozek <jhrozek@redhat.com> wrote:
>
> > On Wed, Oct 10, 2012 at 10:34:46AM +0300, Aziz Sasmaz wrote:
> > > Hi,
> > >
> > > I use sssd on all servers in our infrastruceture.  Most of them Redhat,
> > > Centos and debian. It works very well with these OSes.
> > >  And we have some gentoo linux machines.  I had  some difficulties
> > > configuring sssd when I want to use ldaps
> > >
> > > [domain/LDAP]
> > > id_provider = ldap
> > > auth_provider = ldap
> > > chpass_provider = ldap
> > > ldap_schema = rfc2307
> > > ldap_uri = ldaps://ldap.xxx.com
> > > ldap_chpass_uri = ldaps://ldap-provider.xxx.com
> > > ldap_search_base = dc=xxx,dc=com
> > > ldap_tls_reqcert = allow
> > > cache_credentials = true
> > > enumerate = true
> > > entry_cache_timeout = 5400
> > > ldap_user_gecos = uid
> > >
> > > When I use ldap_uri = ldap   or  ldap_uri = ldaps  getent works, but
> > logins
> > > are not working. There are interesting entries in log files;
> > >
> > > sssd_LDAP
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_new_service] (0x0080):
> > > Creating new service 'LDAP'
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_add_server] (0x0080):
> > > Adding new server 'ldap.xxx.com', to service 'LDAP'
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_new_service] (0x0080):
> > > Creating new service 'LDAP_CHPASS'
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_add_server] (0x0080):
> > > Adding new server 'ldap-provider.xxx.com', to service 'LDAP_CHPASS'
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [sssm_ldap_sudo_init]
> > (0x0080):
> > > Sudo init handler called but SSSD is built without sudo support, ignoring
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [sssm_ldap_autofs_init]
> > > (0x0080): Autofs init handler called but SSSD is built without autofs
> > > support, ignoring
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [be_process_init] (0x0020):
> > No
> > > Session module provided for [LDAP] !!
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [be_process_init] (0x0020):
> > No
> > > host info module provided for [LDAP] !!
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [main] (0x0020): Backend
> > > provider (LDAP) started!
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]] [sdap_sys_connect_done]
> > > (0x0080): Failed to set LDAP SASL nocanon option to true. If your system
> > is
> > > configured to use SASL, LDAP operations might fail.
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]] [simple_bind_done] (0x0080):
> > > Bind result: Success(0), no errmsg set
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]] [sdap_process_group_send]
> > > (0x0040): No Members. Done!
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]] [sdap_process_group_send]
> > > (0x0040): No Members. Done!
> > >
> > > sssd_nss
> > > (Wed Oct 10 09:58:24 2012) [sssd[nss]] [nss_dp_reconnect_init] (0x0010):
> > > Could not reconnect to LDAP provider.
> > > (Wed Oct 10 09:58:54 2012) [sssd[nss]] [sbus_reconnect] (0x0080): Making
> > > reconnection attempt 8 to
> > > [unix:path=/var/lib/sss/pipes/private/sbus-dp_LDAP]
> > > (Wed Oct 10 09:58:54 2012) [sssd[nss]] [sbus_reconnect] (0x0020): Failed
> > to
> > > open connection: name=org.freedesktop.DBus.Error.NoServer, message=Failed
> > > to connect to socket /var/lib/sss/pipes/private/sbus-dp_LDAP: Connection
> > > refused
> > >
> > > sssd_pam
> > > (Wed Oct 10 09:59:24 2012) [sssd[pam]] [pam_dp_reconnect_init] (0x0010):
> > > Could not reconnect to LDAP provider.
> > > (Wed Oct 10 09:59:54 2012) [sssd[pam]] [sbus_reconnect] (0x0080): Making
> > > reconnection attempt 10 to
> > > [unix:path=/var/lib/sss/pipes/private/sbus-dp_LDAP]
> > > (Wed Oct 10 09:59:54 2012) [sssd[pam]] [sbus_reconnect] (0x0020): Failed
> > to
> > > open connection: name=org.freedesktop.DBus.Error.NoServer, message=Failed
> > > to connect to socket /var/lib/sss/pipes/private/sbus-dp_LDAP: Connection
> > > refused
> > >
> > > It says  connection refused but there is no network issue with ldap
> > > servers, all ports opened. Could you pleasegive me advice resolving this
> > > issue?
> > >
> > > Thanks,
> > >
> > > AS
> >
> > Hi,
> >
> > the Connection Refused message does not describe a connection to the
> > server but rather connection via unix sockets between different parts of
> > the SSSD. Can you check the following for me?
> >
> > 1) ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP
> > It should be a symlink pointing to
> > /var/lib/sss/pipes/private/sbus-dp_LDAP.$PID where $PID should
> > correspond to the PID number of the sssd_be process.
> >
> > 2) Does restart of the SSSD clear things up?
> >
> > 3) If not, can you paste or attache the DEBUG messages that the SSSD
> > prints after startup?
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel@lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >
>
>
> Yes there is symbolic link for that.
>
> root@admin01 ~#  ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP
> lrwxrwxrwx 1 root root 45 2012-10-10 10:29
> /var/lib/sss/pipes/private/sbus-dp_LDAP ->
> /var/lib/sss/pipes/private/sbus-dp_LDAP.31432
>

is 31432 a PID of your sssd_be process? If you issue:
ps -axu | grep sssd_be
there should be a sssd_be process running with parameter --domain LDAP.

Is there anything interesting in /var/log/sssd_LDAP.log ?
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

Hi,

Yes it'is the same number as pid. As you can see;

root@admin01 ~# ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP
lrwxrwxrwx 1 root root 45 2012-10-10 14:54 /var/lib/sss/pipes/private/sbus-dp_LDAP -> /var/lib/sss/pipes/private/sbus-dp_LDAP.32375

root@admin01 ~# ps -fe |grep sssd_be
root     32375 32374  0 14:54 ?        00:00:05 /usr/libexec/sssd/sssd_be --domain LDAP -d 0x00f0 --debug-to-files

sssd_LDAP.log  is below;

(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_new_service] (0x0080): Creating new service 'LDAP'
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_add_server] (0x0080): Adding new server 'ldap.bilyoner.com', to service 'LDAP'
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_new_service] (0x0080): Creating new service 'LDAP_CHPASS'
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_add_server] (0x0080): Adding new server 'ldap-provider.bilyoner.com', to service 'LDAP_CHPASS'
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [sssm_ldap_sudo_init] (0x0080): Sudo init handler called but SSSD is built without sudo support, ignoring
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [sssm_ldap_autofs_init] (0x0080): Autofs init handler called but SSSD is built without autofs support, ignoring
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [be_process_init] (0x0020): No Session module provided for [LDAP] !!
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [be_process_init] (0x0020): No host info module provided for [LDAP] !!
(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [main] (0x0020): Backend provider (LDAP) started!
(Wed Oct 10 14:53:45 2012) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0080): Failed to set LDAP SASL nocanon option to true. If your system is configured to use SASL, LDAP operations might fail.