On Fri, 29 Jul 2011, Jakub Hrozek wrote:
On 07/29/2011 12:44 PM, Jakub Hrozek wrote:
> On 07/29/2011 12:07 PM, John Hodrien wrote:
>> I've looked at this, but can't see the wood for the trees.
>>
>> Starting from 1.59 I can't use GSSAPI or TLS with LDAP. I've tried all
>> versions up to current git and I get the same basic result.
>>
>> Undefining HAVE_LDAP_INIT_FD by editing the ldap.m4 to remove the test returns
>> it to life. Equally, not using TLS or GSSAPI works.
>>
>> This is pointed at an Active Directory domain, using a machine credential for
>> the authentication.
>>
>> Here's a stack trace from sssd_be aginst the current git HEAD
>> (d6354aa46716751a41ddab86bc64c1c7c218c5cc) when using GSSAPI:
>
> What distribution are you running? What openldap library versions?
>
Also can you attach your sanitized sssd.conf?
Thanks for the help with this.
CentOS 6.0, but with updated packages built from RHEL SRPMS (ding-libs/krb5)
to support more recent sssd. This likely to be a problem of my own making?
openldap-2.4.19-15.el6_0.2.x86_64 (original CentOS 6.0 package).
Built from RHEL SRPMS:
krb5-1.9-9.el6.src.rpm
ding-libs-0.1.2-6.el6.src.rpm
sssd.conf:
[sssd]
config_file_version = 2
debug_level = 10
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = default
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/default]
lookup_family_order=ipv4_only
auth_provider = krb5
cache_credentials = false
krb5_realm =
EXAMPLE.COM
chpass_provider = krb5
id_provider = ldap
dns_discovery_domain =
EXAMPLE.COM
krb5_validate = true
krb5_renew_interval = 300
min_id = 100
ldap_force_upper_case_realm = True
ldap_schema = rfc2307bis
ldap_user_name = sAMAccountName
ldap_user_uid_number = msSFU30UidNumber
ldap_user_gid_number = msSFU30GidNumber
ldap_user_home_directory = msSFU30HomeDirectory
ldap_user_shell = msSFU30LoginShell
ldap_user_principal = userPrincipalName
ldap_group_name = cn
ldap_group_gid_number = msSFU30GidNumber
enumerate = false
ldap_referrals = false
ldap_search_base = dc=example,dc=com
ldap_group_search_base = dc=example,dc=com
ldap_sasl_mech = gssapi
ldap_sasl_authid = SCSJHTEST1$
debug_level = 10
ldap_pwd_policy = none
ldap_user_object_class = user
ldap_group_object_class = group
ldap_user_gecos = displayName
ldap_user_gid_number = primaryGroupID
jh