On Wed, 2012-03-21 at 17:05 +1100, Rolf Loudon wrote:
...
Firstly the logs tell me that the principal is not found in the KDC
database. But when I inspect it using ADSI Edit I see the SPN and UPN
values that I expect to see and that match the principal it says it
cannot find. Likewise these principals can be seen from klist -kte
/etc/krb5/keytab (though it doesn't complain about not finding
anything in the key tab)
I can get round that issue temporarily by specifying the principal name
using ldap_sasl_authid. I'd still like to know what is wrong in that
instance.
I'm guessing you're likely hitting
https://fedorahosted.org/sssd/ticket/1269
We're going to try to fix that for the 1.8.2 release, so it should get
pulled into Ubuntu 12.04 LTS as a bugfix eventually.
Secondly the ldap_search_base strangely affects the authentication and
the user lookup. I don't know if the searching is subtree or not. I
can't see a parameter to make this explicit.
Searches are always SUBTREE by default (in 1.5.x I don't think this was
even optional). The correct behavior *should* be to use the
dc=domainpart1,dc=domainpart2,dc=domainpart3
If I set ldap_search_base (or ldap_user_search_base) to
dc=domainpart1,dc=domainpart2,dc=domainpart3 then I get errors about
ldap_sasl_interactive_bind_s failing. however if I set the
ldap_search_base to
cn=users,dc=domainpart1,dc=domainpart2,dc=domainpart3 then those
errors go away and the lookup is done.
Can you please set 'debug_level = 6' in the [domain/DOMAINNAME] section
of sssd.conf, restart SSSD, try this and then send the (sanitized) logs
to me? If the SASL bind is failing where the user lookups are working
properly, then it's most likely a bug and we need logs to figure out
where the failure is happening.