On Thu, 2012-03-22 at 10:58 -0400, Stephen Gallagher wrote:
On Thu, 2012-03-22 at 09:10 +1100, Rolf Loudon wrote:
> Hello
>
> Thanks. Yes ticket 1269 sounds like the behaviour. I presume i could
> prove this by creating a key tab with only a single principal in it and
> point sssd to it with krb5_key = and that is a workaround?
>
> Sending logs separately.
Well, you can create a new keytab and use ldap_krb5_keytab = to point at
it, OR you can just manually specify the ldap_sasl_authid = value for
right now. Both are valid workarounds while we fix 1269.
I'll take a look at the other logs shortly.
So I took a look at those logs and here's what I saw:
(Thu Mar 22 09:05:54 2012) [sssd[be[my.fqdn.domain]]] [sdap_rebind_proc]
(1): ldap_sasl_interactive_bind_s failed (-2)[Local error]
(Thu Mar 22 09:05:54 2012) [sssd[be[my.fqdn.domain]]] [sdap_rebind_proc]
(1): ldap_sasl_interactive_bind_s failed (-2)[Local error]
(Thu Mar 22 09:05:54 2012) [sssd[be[my.fqdn.domain]]] [sdap_rebind_proc]
(1): ldap_sasl_interactive_bind_s failed (-2)[Local error]
(Thu Mar 22 09:06:00 2012) [sssd[be[my.fqdn.domain]]] [sdap_id_op_done]
(5): communication error on cached connection, moving to next server
That happens when Active Directory is responding to the LDAP BIND
request with a referral, which is unsupported by the openldap client
libraries, and therefore by us as well.
It's probably a bug in our code for us to be attempting to track
referrals during a bind. Would you please open a bug on this at
https://fedorahosted.org/sssd ?
If you need an account, you can get one free at
https://admin.fedoraproject.org/accounts/