On 05/21/2012 02:44 PM, Jakub Hrozek wrote:
It's hard to tell from a short snippet..can you paste more context,
especially before the failed connection attempt?

Because the snippet says that the *server* status is working, but *port 389*
is not working, I assume that there is also a Kerberos port configured in
the sssd.conf on the dcpra1.XXX machine and the Kerberos attempt failed
before SSSD got to resolving the LDAP service.

The fail over mechanism distinguishes between a server and a port
because it's quite possible that one machine runs several services and
only one of the services can be down. At the same time, if the server
cannot even be resolved, the fail over shouldn't (and can't) try
connecting to any of the ports configured.
sssd-devel mailing list
Ok, that was most likely a fake alarm - after deeper log investigation it looked out like sssd was unable to lookup KDC for a given realm.
I had 2 dns servers in my resolv.conf - the 1st one could not handle SRV lookups well, the second was fine.
The problem went away after removing the 1st one - will keep monitoring it.