Hi, i'd like to use sssd in ldap mode: id_provider = ldap auth_provider = ldap
against an Active Directory domain. Yes krb5 would be better but i only have a BIND account and cannot add computer objects.
Reading guides here: https://wiki.ubuntu.com/Enterprise/Authentication/sssd
it says i don't need Posix attributes (which I don't have), so I have enabled: ldap_id_mapping = true fallback_homedir = /home/%d/%u default_shell = /bin/bash
I can bind with LDAPS and can seem to get user info from the domain: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=Some User,OU=Admin Accounts,DC=dev,DC=somedomain,DC=com]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [displayName] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [memberOf] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [userAccountControl] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [primaryGroupID] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [accountExpires] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [userPrincipalName] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimeStamp] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_result] (0x2000): Trace: sh[0x7f5d15fbc030], connected[1], ops[0x7f5d1639d140], ldap[0x7f5d15fb5cd0] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_op_destructor] (0x2000): Operation 3 finished (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x4000): Retrieved total 1 users
The UID mapping seems to succeed: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Save user (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x4000): Failed to retrieve UUID [2][No such file or directory]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_primary_name] (0x0400): Processing object someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Processing user someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x1000): Mapping user [someuser] objectSID [S-1-5-21-3970895924-989261097-3267629119-1443] to unix ID
But it gets no further with this message: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_idmap_primary_gid] (0x0080): no primary group ID provided (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Cannot get the GID for [someuser] in domain [extdev]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Failed to save user [someuser] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring.
Any ideas what I'm doing wrong? Is this possible? Various (old) posts suggests it is. Have tried against two different domains with identical result ( one a cleanly installed 2012R2 domain ).
Thanks in advance!!
On Fri, Aug 26, 2016 at 04:49:27AM -0000, daniel.hermans@nab.com.au wrote:
Hi, i'd like to use sssd in ldap mode: id_provider = ldap auth_provider = ldap
The users list is probably better then -devel for questions: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
against an Active Directory domain. Yes krb5 would be better but i only have a BIND account and cannot add computer objects.
Reading guides here: https://wiki.ubuntu.com/Enterprise/Authentication/sssd
it says i don't need Posix attributes (which I don't have), so I have enabled: ldap_id_mapping = true fallback_homedir = /home/%d/%u default_shell = /bin/bash
I can bind with LDAPS and can seem to get user info from the domain: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=Some User,OU=Admin Accounts,DC=dev,DC=somedomain,DC=com]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [displayName] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [memberOf] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [userAccountControl] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [primaryGroupID] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [accountExpires] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [userPrincipalName] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimeStamp] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_result] (0x2000): Trace: sh[0x7f5d15fbc030], connected[1], ops[0x7f5d1639d140], ldap[0x7f5d15fb5cd0] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_op_destructor] (0x2000): Operation 3 finished (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x4000): Retrieved total 1 users
The UID mapping seems to succeed: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Save user (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x4000): Failed to retrieve UUID [2][No such file or directory]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_primary_name] (0x0400): Processing object someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Processing user someuser
^^^^
Looks like you need to define ldap_idmap_default_domain_sid, the LDAP provider cannot (unlike the AD provider) autodiscover the domain SID.
I guess the guide could use a fix.. (there are some more oddities, like the explicit sudo_provider=none..)
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x1000): Mapping user [someuser] objectSID [S-1-5-21-3970895924-989261097-3267629119-1443] to unix ID
But it gets no further with this message: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_idmap_primary_gid] (0x0080): no primary group ID provided (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Cannot get the GID for [someuser] in domain [extdev]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Failed to save user [someuser] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring.
Any ideas what I'm doing wrong? Is this possible? Various (old) posts suggests it is. Have tried against two different domains with identical result ( one a cleanly installed 2012R2 domain ).
Thanks in advance!! _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org
sorry about that - didn't realise there was a separate list - should i close this request?
- if i define ldap_idmap_default_domain_sid, clear /var/lib/sss/db/* and restart sssd no longer reports this: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain
so thankyou!!
Unfortunately it still reports the other errors thoughand fails to find a credential... nslcd can log a user in with same credentials so I'm pretty sure the domain and bind user are ok..
Thanks for reading!
On Fri, Aug 26, 2016 at 07:16:36AM -0000, Daniel Hermans wrote:
sorry about that - didn't realise there was a separate list - should i close this request?
- if i define ldap_idmap_default_domain_sid, clear /var/lib/sss/db/* and restart sssd no longer reports this:
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain
so thankyou!!
Unfortunately it still reports the other errors thoughand fails to find a credential... nslcd can log a user in with same credentials so I'm pretty sure the domain and bind user are ok..
It would be best to open a new thread on sssd-users and post the logs on the -users list.
HI, sorry I didn't get any response on sssd-users I'm totally out of practice with C ( 10 years+ ) but have got slightly further by editing function sdap_get_idmap_primary_gid in src/provides/ldap/sdap_async_users.c
as a hack i commented out the 'goto' in this block: ret = sysdb_attrs_get_uint32_t(attrs, opts->user_map[SDAP_AT_USER_PRIMARY_GROUP].sys_name, &primary_gid); if (ret != EOK) { DEBUG(SSSDBG_MINOR_FAILURE, "no primary group ID provided\n"); ret = EINVAL; /* goto done; */ }
obviously the primary group is not known ( as idmap is active it is being generated ) so the then the next code block correctly gets the GID from the DomainSID : if (!dom_sid_str) { ret = sdap_idmap_get_dom_sid_from_object(tmpctx, sid_str, &dom_sid_str);
I can now 'getent passwd [user]' and get data back.
Would wrapping the first block in something like: if (!use_id_mapping) {
suffice?
On Mon, Aug 29, 2016 at 04:49:57AM -0000, Daniel Hermans wrote:
HI, sorry I didn't get any response on sssd-users
This was just because nobody had the time to answer until today (most developers are in EU..). It's still better to post on the users list because the archives will be searchable later by other affected users who happen to have the same issue.
See my reply there, I think it's just a misconfiguration in your sssd.conf.
sssd-devel@lists.fedorahosted.org