Hello
Thanks. Yes ticket 1269 sounds like the behaviour. I presume i could prove this by
creating a key tab with only a single principal in it and point sssd to it with krb5_key =
and that is a workaround?
Sending logs separately.
r.
On 22/03/2012, at 12:57 AM, Stephen Gallagher wrote:
On Wed, 2012-03-21 at 17:05 +1100, Rolf Loudon wrote:
...
> Firstly the logs tell me that the principal is not found in the KDC
> database. But when I inspect it using ADSI Edit I see the SPN and UPN
> values that I expect to see and that match the principal it says it
> cannot find. Likewise these principals can be seen from klist -kte
> /etc/krb5/keytab (though it doesn't complain about not finding
> anything in the key tab)
>
> I can get round that issue temporarily by specifying the principal name
> using ldap_sasl_authid. I'd still like to know what is wrong in that
> instance.
>
I'm guessing you're likely hitting
https://fedorahosted.org/sssd/ticket/1269
We're going to try to fix that for the 1.8.2 release, so it should get
pulled into Ubuntu 12.04 LTS as a bugfix eventually.
>
> Secondly the ldap_search_base strangely affects the authentication and
> the user lookup. I don't know if the searching is subtree or not. I
> can't see a parameter to make this explicit.
>
Searches are always SUBTREE by default (in 1.5.x I don't think this was
even optional). The correct behavior *should* be to use the
dc=domainpart1,dc=domainpart2,dc=domainpart3
> If I set ldap_search_base (or ldap_user_search_base) to
> dc=domainpart1,dc=domainpart2,dc=domainpart3 then I get errors about
> ldap_sasl_interactive_bind_s failing. however if I set the
> ldap_search_base to
> cn=users,dc=domainpart1,dc=domainpart2,dc=domainpart3 then those
> errors go away and the lookup is done.
>
Can you please set 'debug_level = 6' in the [domain/DOMAINNAME] section
of sssd.conf, restart SSSD, try this and then send the (sanitized) logs
to me? If the SASL bind is failing where the user lookups are working
properly, then it's most likely a bug and we need logs to figure out
where the failure is happening.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel