Thanks,
That did the trick.
I did not have this defined in either my 1.5 or 1.8 instances? Not
sure why 1.8 acts differently.
This fixed my issues for 1.8 not being able to authenticate as well as
sped up authentication for my 1.5.
On Mon, Aug 13, 2012 at 10:52 AM, Stephen Gallagher <sgallagh(a)redhat.com> wrote:
On Mon, 2012-08-13 at 10:46 -0400, Derek Page wrote:
> Hi Devs,
>
> I am seeing an issue with sssd-1.8.0-32.el6.x86_64
>
> Issue description.
> When system is on a different VLAN as the Active directory servers
> logins are really slow or timeout and I see these errors.
>
> I see this in the syslog
> Aug 13 10:27:32 m4deploy01 sssd_be: GSSAPI Error: An invalid name was
> supplied (Unknown error)
>
From this log, it looks like you're getting referrals to Active
Directory servers that don't support GSSAPI binds (or don't support
allowing them from your particular host). As a workaround right now, I'd
strongly recommend setting 'ldap_referrals = False' on Active Directory
environments. AD mistreats referrals pretty badly and it results in poor
performance all-around.
I notice you have ldap_referrals = false present but commented-out.
Could that be the difference between your RHEL 5 and RHEL 6
environments?
> I see this in the sssd log
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_parse_entry] (0x4000): OriginalDN: [CN=Derek
> Page,OU=Concord,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
> [
ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com]
> with fd [35].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
> [
ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com]
> with fd [36].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
> [
ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com] with fd
> [37].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
> (-2)[Local error]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x1000): Failed to bind to
> [
ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
> with fd [37].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
> (-2)[Local error]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x1000): Failed to bind to
> [
ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
> with fd [36].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
> (-2)[Local error]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x1000): Failed to bind to
> [
ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
> with fd [35].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_message] (0x4000): Message type:
> [LDAP_RES_SEARCH_REFERENCE]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_message] (0x4000): Message type:
> [LDAP_RES_SEARCH_REFERENCE]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_message] (0x4000): Message type:
> [LDAP_RES_SEARCH_REFERENCE]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
> (Mon Aug 13 10:30:09 2012) [sssd[be[my.domain.com]]] [sbus_dispatch]
> (0x4000): dbus conn: 2163580
>
> If I moved the system to the same VLAN as the Active Directory servers
> and these errors go away and everything works great.
>
> Other systems running sssd-1.5.1-49.el5_8.1 on a different VLAN then
> my Active Directory servers also work great.
> Is this an issue with 1.8.0-32?
>
> Any suggestions?
>
>
> Here are my configs.
>
> #/etc/krb5.conf
> [logging]
> default = FILE:/var/log/krb5libs.log
> kdc = FILE:/var/log/krb5kdc.log
> admin_server = FILE:/var/log/kadmind.log
>
> [libdefaults]
> default_realm =
MYDOMAIN.COM
> dns_lookup_realm = false
> dns_lookup_kdc = false
> ticket_lifetime = 24h
> renew_lifetime = 7d
> forwardable = true
> default_tgs_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
> default_tkt_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
> permitted_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
>
> [realms]
>
MY.DOMAIN.COM = {
> kdc = ad.my.domain.com:88
> admin_server =
ad.my.domain.com
> default_domain =
my.domain.com
> }
>
> [domain_realm]
> .my.domain.com =
MY.DOMAIN.COM
>
my.domain.com =
MY.DOMAIN.COM
>
>
>
>
> #/etc/sssd/sssd.conf
> [domain/default]
>
> cache_credentials = fasle
> [sssd]
> config_file_version = 2
> domains =
my.domain.com
>
> reconnection_retries = 3
>
> sbus_timeout = 30
> services = nss, pam
>
> [nss]
> filter_groups = root
> filter_users = root
> reconnection_retries = 3
>
> [pam]
> reconnection_retries = 3
>
> [
domain/my.domain.com]
> cache_credentials = false
> enumerate = false
> min_id = 80
> max_id = 30000
> id_provider = ldap
> auth_provider = krb5
> ldap_uri =
ldap://ad3.my.domain.com/
> ldap_schema = rfc2307bis
> ldap_user_search_base = dc=my,dc=domain,dc=com
> ldap_user_object_class = person
> ldap_user_modify_timestamp = whenChanged
> ldap_user_home_directory = unixHomeDirectory
> ldap_user_shell = loginShell
> ldap_user_principal = userPrincipalName
> ldap_group_search_base = dc=my,dc=domain,dc=com
> ldap_group_object_class = group
> ldap_group_modify_timestamp = whenChanged
> ldap_group_nesting_level = 5
> ldap_account_expire_policy = ad
> ldap_sasl_authid = M4DEPLOY01$(a)MY.DOMAIN.COM
> ldap_krb5_init_creds = true
> ldap_pwd_policy = mit_kerberos
> chpass_provider = krb5
> ldap_sasl_mech = GSSAPI
> krb5_realm =
MY.DOMAIN.COM
> krb5_validate = true
> ldap_user_name = sAMAccountName
> ldap_user_uid_number = uidNumber
> ldap_user_gid_number = gidNumber
> ldap_user_home_directory = unixHomeDirectory
> ldap_user_shell = loginShell
> ldap_user_principal = userPrincipalName
> ldap_group_object_class = group
> ldap_group_name = sAMAccountName
> ldap_group_gid_number = gidNumber
> ldap_force_upper_case_realm = true
> #ldap_referrals = false
>
> # User Group and Account Access
> access_provider = simple
> #simple_allow_users =
> simple_allow_groups = m4_login
>
> debug_level = 10
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel