Stephen, I installed the packages you sent me. Here is the new log output:

(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [simple_bind_send] (4): Executing simple bind as: uid=testuser,ou=people,dc=mydomain,dc=com
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: sh[0x8f6900], connected[1], ops[0xe3b510], ldap[0xc3b000]
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [sdap_process_result] (4): ldap_result gave -1, something bad happened!
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [sdap_process_result] (4): ldap_result failed: [(null)]
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [sdap_handle_release] (8): Trace: sh[0x8f6900], connected[1], ops[0xe3b510], ldap[0xc3b000], destructor_lock[0], release_memory[0]
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [remove_connection_callback] (9): Successfully removed connection callback.

To get authentication to work with sssd I found that i have to edit sssd.conf in a couple of places. One, change the ldap_uri to ldap.mydomain.com and Two, change ldap_tls_reqcert to "never". When ldap_tls_reqcert is set to default (hard/demand) authentication fails. I decided to tail access logs on our ldap server to look at the difference in a request from my test machine that works (over 389/ldap) and one that fails (over 686/ldaps)

Failed request:

[10/Feb/2011:14:23:05 -0500] conn=581553 op=9 msgId=11 - SRCH base="ou=people,dc=mydomain,dc=com" scope=2 filter="(&(uid=testuser)(objectClass=posixAccount))" attrs="objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbprincipalname cn modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krblastpwdchange krbpasswordexpiration pwdAttribute"
[10/Feb/2011:14:23:05 -0500] conn=581553 op=9 msgId=11 - RESULT err=0 tag=101 nentries=1 etime=0


Successful request:

[10/Feb/2011:14:33:43 -0500] conn=581558 op=27 msgId=29 - SRCH base="ou=people,dc=mydomain,dc=com" scope=2 filter="(&(uid=testuser)(objectClass=posixAccount))" attrs="objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbprincipalname cn modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krblastpwdchange krbpasswordexpiration pwdAttribute"
[10/Feb/2011:14:33:43 -0500] conn=581558 op=27 msgId=29 - RESULT err=0 tag=101 nentries=1 etime=0

The requests seem to yeild the same results so im confused as to why one is failing and the other is not.

I should note that in the ssl cert directory i am using the same cert that we use on all of the other systems in our environment (mostly RHEL5.3) and i have run cacertdir_rehash on the directory as it says in the sssd-ldap(5) man page.

Any suggestions? Thank you for your help so far.



On Thu, Feb 10, 2011 at 1:59 PM, Stephen Gallagher <sgallagh@redhat.com> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/10/2011 01:53 PM, sssd help wrote:
> Thank you for the reply Stephen. I will begin work on the build you
> provided.
>
> To answer your question about TLS vs SSL, we cant use TLS in our
> environment because of a number of tools we use that need to
> authenticate to ldap and do not support TLS. So for the time being LDAPS
> is the only way to go for us.
>
> I also didnt realize that we were using a slightly outdated version of
> sssd. Ill do some upgrade testing as well and let you know.
>
> Thanks again!

There should be no upgrade issues from 1.2.1-28 to 1.2.1-28.4. There are
just a few bugfixes.

I based the scratch-build I sent you on 1.2.1-28.4 (with the extra
logging patch included)

- --
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1UNZQACgkQeiVVYja6o6OFhwCgpMCAwD5LlY2gA0Aesn+mhc/M
UL4An2CNSB/XbtuoEAcSkFI69eNJULzm
=XaBq
-----END PGP SIGNATURE-----
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel