On Mon, May 21, 2012 at 02:16:11PM +0200, Ondrej Valousek wrote:
Hi List,
I am using sssd (F17) with AD and what I observed is that sssd frequently
marks my AD server working and then "not working". Symptoms:
(Mon May 21 13:58:43 2012) [sssd[be[default]]] [sdap_id_op_connect_step]
(0x4000): beginning to connect
(Mon May 21 13:58:43 2012) [sssd[be[default]]] [fo_resolve_service_send]
(0x0100): Trying to resolve service 'LDAP'
(Mon May 21 13:58:43 2012) [sssd[be[default]]] [get_server_status]
(0x1000): Status of server 'dcpra1.XXX' is 'working'
(Mon May 21 13:58:43 2012) [sssd[be[default]]] [get_port_status] (0x1000):
Port status of port 389 for server 'dcpra1.XXX' is 'not working'
(Mon May 21 13:58:43 2012) [sssd[be[default]]] [fo_resolve_service_send]
(0x0020): No available servers for service 'LDAP'
Sometimes sssd does manage to connect, sometimes not.
I know there is a problem with the AD controller cutting the connection
after some timeout that we can not (yet) handle correctly, but this also
happens shortly after sssd restart.
It's hard to tell from a short snippet..can you paste more context,
especially before the failed connection attempt?
Because the snippet says that the *server* status is working, but *port 389*
is not working, I assume that there is also a Kerberos port configured in
the sssd.conf on the dcpra1.XXX machine and the Kerberos attempt failed
before SSSD got to resolving the LDAP service.
The fail over mechanism distinguishes between a server and a port
because it's quite possible that one machine runs several services and
only one of the services can be down. At the same time, if the server
cannot even be resolved, the fail over shouldn't (and can't) try
connecting to any of the ports configured.