sssd-users April 2013

sssd-users@lists.fedorahosted.org

20 participants
20 discussions

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

RFC: dropping upstream support of RHEL5 starting with 1.10
by Jakub Hrozek 01 May '13

01 May '13

Hi, many new features rely on library APIs and features that are only available in recent versions of SSSD dependencies. As a result, the code often needs #ifdefs and special branches in order to at least compile or run on RHEL5. So far we've been doing nightly builds also for RHEL5 and fixing issues as we were finding them. But recently we are considering dropping support for RHEL5 -- it is causing some engineering effort and at the same time the audience is probably very limited. If you are running super-stable enterprise distribution, chances are you are not all that interested in the latest and possibly very unstable SSSD version. The proposal would be to keep building and supporting the 1.9.x branch for RHEL5 and switch to using RHEL6 as the oldest supported release starting from the 1.10 upstream version. Of course we would still accept patches from any potential contributors. Any objections against the plan?

3 5

Anyone using sudo with AD?
by Ondrej Valousek 29 Apr '13

29 Apr '13

I see sudo package comes with a nice way how to extend the AD schema to support sudo attributes: /usr/share/doc/sudo-1.8.6p3/schema.ActiveDirectory Hence my question: Anyone tried something like: sudo_provider = ad? Thanks, Ondrej

3 6

ldap config
by Brandon Foster 25 Apr '13

25 Apr '13

hey all, Im new to sssd and ldap so be gentle =) I've followed some guides on how to set up sssd ldap client authentication on Centos 6.3 but mine doesnt seem to be working here is my sssd.conf ----- [sssd] config_file_version = 2 services = nss, pam domains = default [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd [pam] [domain/default] auth_provider = ldap debug_level = 9 enumerate = True cache_credentials = True chpass_provider = ldap entry_cache_timeout = 600 krb5_realm = EXAMPLE.COM krb5_server = kerberos.example.com ldap_chpass_uri = ldaps://xx.xx.xx.xx:<PORT>/ ldap_force_upper_case_realm = True id_provider = ldap ldap_group_member = uniquemember ldap_group_object_class = group ldap_id_use_start_tls = False ldap_pwd_policy = none ldap_search_base = ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example ldap_schema = rfc2307bis ldap_tls_cacertdir = /etc/openldap/cacerts ldap_tls_reqcert = never ldap_uri = ldaps://xx.xx.xx.xx:<PORT>/ ldap_user_gecos = displayName ldap_user_home_directory = unixHomeDirectory ldap_user_name = cn ldap_user_object_class = user ------ ldapsearcg -z 'cn=username' comes back with all the information about the user but id username takes a really long time and then returns no such user. here is a piece of the log: -------------------------------------------------------------------------- (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [recreate_ares_channel] (0x0100): Initializing new c-ares channel (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [resolv_get_family_order] (0x1000): Lookup order: ipv4_first (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [fo_context_init] (0x0400): Created new fail over context, retry timeout is 30 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sysdb_domain_init_internal] (0x0200): DB File for default: /var/lib/sss/db/cache_default.ldb (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x14778c0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x148d4d0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Destroying timer event 0x148d4d0 "ltdb_timeout" (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Ending timer event 0x14778c0 "ltdb_callback" (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x0400): asq: Unable to register control with rootdse! (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x148f840 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x148d4d0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Destroying timer event 0x148d4d0 "ltdb_timeout" (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Ending timer event 0x148f840 "ltdb_callback" (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x14778c0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x1490390 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Destroying timer event 0x1490390 "ltdb_timeout" (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Ending timer event 0x14778c0 "ltdb_callback" (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_init_connection] (0x0200): Adding connection 14905E0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_add_watch] (0x2000): 0x1490a30/0x148f9e0 (15), -/W (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x1490a30/0x148d2f0 (15), R/- (disabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [monitor_common_send_id] (0x0100): Sending ID: (%BE_default,1) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_add_timeout] (0x2000): 0x1490db0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x1490a30/0x148d2f0 (15), R/- (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x1490a30/0x148f9e0 (15), -/W (disabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sss_names_init] (0x0100): Using re [(?P<name>[^@]+)@?(?P<domain>[^@]*$)]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [create_socket_symlink] (0x1000): Symlinking the dbus path /var/lib/sss/pipes/private/sbus-dp_default.639 to a link /var/lib/sss/pipes/private/sbus-dp_default (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_new_server] (0x0400): D-BUS Server listening on unix:path=/var/lib/sss/pipes/private/sbus-dp_default.639,guid=604ced1a38c1615f3905892500000097 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_add_watch] (0x2000): 0x148cec0/0x148da70 (16), R/- (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x1000): Loading backend [ldap] with path [/usr/lib64/sssd/libsss_ldap.so]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_uri has value ldaps://xx.xx.xx.xx:<port>/ (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_backup_uri has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_search_base has value ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_default_bind_dn has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_default_authtok_type has value password (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_default_authtok has no binary value. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_search_timeout has value 6 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_network_timeout has value 6 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_opt_timeout has value 6 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_tls_reqcert has value never (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_user_search_base has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_user_search_scope has value sub (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_user_search_filter has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_group_search_base has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_group_search_scope has value sub (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_group_search_filter has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_service_search_base has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sudo_search_base has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sudo_full_refresh_interval has value 21600 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sudo_smart_refresh_interval has value 900 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sudo_use_host_filter is TRUE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sudo_hostnames has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sudo_ip has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sudo_include_netgroups is TRUE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sudo_include_regexp is TRUE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_autofs_search_base has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_schema has value rfc2307bis (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_offline_timeout has value 60 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_force_upper_case_realm is FALSE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_enumeration_refresh_timeout has value 300 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_purge_cache_timeout has value 10800 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_tls_cacert has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_tls_cacertdir has value /etc/openldap/cacerts (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_tls_cert has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_tls_key has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_tls_cipher_suite has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_id_use_start_tls is FALSE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_id_mapping is FALSE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sasl_mech has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sasl_authid has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sasl_realm has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sasl_minssf has value -1 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_krb5_keytab has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_krb5_init_creds is TRUE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option krb5_server has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option krb5_backup_server has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option krb5_realm has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option krb5_canonicalize is TRUE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_pwd_policy has value none (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_referrals is TRUE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option account_cache_expiration has value 0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_dns_service_name has value ldap (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_krb5_ticket_lifetime has value 86400 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_access_filter has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_netgroup_search_base has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_group_nesting_level has value 2 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_deref has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_account_expire_policy has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_access_order has value filter (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_chpass_uri has value ldaps://xx.xx.xx.xx:<port>/ (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_chpass_backup_uri has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_chpass_dns_service_name has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_chpass_update_last_change is FALSE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_enumeration_search_timeout has value 60 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_auth_disable_tls_never_use_in_production is FALSE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_page_size has value 1000 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_deref_threshold has value 10 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_sasl_canonicalize is FALSE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_connection_expire_timeout has value 900 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_disable_paging is FALSE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_idmap_range_min has value 200000 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_idmap_range_max has value 2000200000 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_idmap_range_size has value 200000 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_idmap_autorid_compat is FALSE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_idmap_default_domain has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_idmap_default_domain_sid has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_groups_use_matching_rule_in_chain is FALSE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [dp_get_options] (0x0400): Option ldap_initgroups_use_matching_rule_in_chain is FALSE (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldap_get_options] (0x0400): Option ldap_user_search_base set to ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldap_get_options] (0x0400): Option ldap_group_search_base set to ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldap_get_options] (0x0400): Option ldap_netgroup_search_base set to ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldap_get_options] (0x0400): Option ldap_service_search_base set to ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [common_parse_search_base] (0x0100): Search base added: [DEFAULT][ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example][SUBTREE][] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [common_parse_search_base] (0x0100): Search base added: [USER][ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example][SUBTREE][] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [common_parse_search_base] (0x0100): Search base added: [GROUP][ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example][SUBTREE][] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [common_parse_search_base] (0x0100): Search base added: [NETGROUP][ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example][SUBTREE][] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [common_parse_search_base] (0x0100): Search base added: [SERVICE][ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example][SUBTREE][] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_entry_usn has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_rootdse_last_usn has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_object_class has value user (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_name has value cn (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_pwd has value userPassword (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_uid_number has value uidNumber (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_gid_number has value gidNumber (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_gecos has value displayName (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_home_directory has value unixHomeDirectory (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_shell has value loginShell (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_principal has value krbPrincipalName (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_fullname has value cn (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_member_of has value memberOf (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_uuid has value nsUniqueId (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_objectsid has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_primary_group has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_modify_timestamp has value modifyTimestamp (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_entry_usn has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_shadow_last_change has value shadowLastChange (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_shadow_min has value shadowMin (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_shadow_max has value shadowMax (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_shadow_warning has value shadowWarning (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_shadow_inactive has value shadowInactive (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_shadow_expire has value shadowExpire (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_shadow_flag has value shadowFlag (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_krb_last_pwd_change has value krbLastPwdChange (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_krb_password_expiration has value krbPasswordExpiration (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_pwd_attribute has value pwdAttribute (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_authorized_service has value authorizedService (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_ad_account_expires has value accountExpires (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_ad_user_account_control has value userAccountControl (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_ns_account_lock has value nsAccountLock (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_authorized_host has value host (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_nds_login_disabled has value loginDisabled (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_nds_login_expiration_time has value loginExpirationTime (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_nds_login_allowed_time_map has value loginAllowedTimeMap (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_user_ssh_public_key has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_group_object_class has value group (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_group_name has value cn (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_group_pwd has value userPassword (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_group_gid_number has value gidNumber (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_group_member has value uniquemember (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_group_uuid has value nsUniqueId (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_group_objectsid has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_group_modify_timestamp has value modifyTimestamp (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_group_entry_usn has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_netgroup_object_class has value nisNetgroup (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_netgroup_name has value cn (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_netgroup_member has value memberNisNetgroup (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_netgroup_triple has value nisNetgroupTriple (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_netgroup_uuid has value nsUniqueId (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_netgroup_modify_timestamp has value modifyTimestamp (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_service_object_class has value ipService (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_service_name has value cn (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_service_port has value ipServicePort (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_service_proto has value ipServiceProtocol (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_service_entry_usn has no value (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [krb5_try_kdcip] (0x0100): No KDC found in configuration, trying legacy option (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sssm_ldap_id_init] (0x1000): Service name for discovery set to ldap (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [fo_new_service] (0x0400): Creating new service 'LDAP' (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_urls_init] (0x0400): Added URI ldaps://xx.xx.xx.xx:<port>/ (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [fo_add_server] (0x0080): Adding new server 'xx.xx.xx.xx', to service 'LDAP' (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x149a4b0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x149a5a0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Destroying timer event 0x149a5a0 "ltdb_timeout" (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldb] (0x4000): Ending timer event 0x149a4b0 "ltdb_callback" (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldap_id_enumerate_set_timer] (0x0400): Scheduling next enumeration at 1366735849.298624 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_process_init] (0x2000): ID backend target successfully loaded from provider [ldap]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x1000): Backend [ldap] already loaded. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sssm_ldap_id_init] (0x2000): Re-using sdap_id_ctx for this provider (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_process_init] (0x2000): AUTH backend target successfully loaded from provider [ldap]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x0200): no module name found in confdb, using [permit]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_process_init] (0x2000): ACCESS backend target successfully loaded from provider [permit]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x1000): Backend [ldap] already loaded. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sssm_ldap_id_init] (0x2000): Re-using sdap_id_ctx for this provider (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [fo_new_service] (0x0400): Creating new service 'LDAP_CHPASS' (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_urls_init] (0x0400): Added URI ldaps://xx.xx.xx.xx:<port>/ (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [fo_add_server] (0x0080): Adding new server 'xx.xx.xx.xx', to service 'LDAP_CHPASS' (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_process_init] (0x2000): CHPASS backend target successfully loaded from provider [ldap]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_process_init_sudo] (0x0400): SUDO is not listed in services, disabling SUDO module. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_process_init] (0x0080): No SUDO module provided for [default] !! (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x0200): no module name found in confdb, using [ldap]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x1000): Backend [ldap] already loaded. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sssm_ldap_id_init] (0x2000): Re-using sdap_id_ctx for this provider (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_autofs_init] (0x2000): Initializing autofs LDAP back end (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [ldap_get_autofs_options] (0x0200): Option ldap_autofs_search_base set to ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [common_parse_search_base] (0x0100): Search base added: [AUTOFS][ou=organizationunit3,ou=organizationunit2,ou=organizationunit1,o=example][SUBTREE][] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_autofs_map_object_class has value automountMap (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_autofs_map_name has value automountMapName (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_autofs_entry_object_class has value automount (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_autofs_entry_key has value automountKey (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sdap_get_map] (0x0400): Option ldap_autofs_entry_value has value automountInformation (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_process_init] (0x2000): autofs backend target successfully loaded from provider [ldap]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x0200): no module name found in confdb, using [ldap]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x1000): Backend [ldap] already loaded. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_process_init] (0x0020): No selinux module provided for [default] !! (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x0200): no module name found in confdb, using [ldap]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x1000): Backend [ldap] already loaded. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_process_init] (0x0020): No host info module provided for [default] !! (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x0200): no module name found in confdb, using [ldap]. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [load_backend_module] (0x1000): Backend [ldap] already loaded. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_process_init] (0x0020): Subdomains are not supported for [default] !! (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [main] (0x0400): Backend provider (default) started! (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 14905E0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 14905E0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x1490a30/0x148d2f0 (15), R/- (disabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x1490a30/0x148f9e0 (15), -/W (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x1490a30/0x148d2f0 (15), R/- (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x1490a30/0x148f9e0 (15), -/W (disabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_remove_timeout] (0x2000): 0x1490db0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 14905E0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): Dispatching. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [id_callback] (0x0100): Got id ack and version (1) from Monitor (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_server_init_new_connection] (0x0200): Entering. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_server_init_new_connection] (0x0200): Adding connection 0x149b3f0. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_init_connection] (0x0200): Adding connection 149B3F0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_add_watch] (0x2000): 0x149a760/0x149bb40 (18), -/W (disabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x149a760/0x1499570 (18), R/- (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_server_init_new_connection] (0x0200): Got a connection (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_client_init] (0x0100): Set-up Backend ID timeout [0x149be50] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 149B3F0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x149a760/0x1499570 (18), R/- (disabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x149a760/0x149bb40 (18), -/W (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x149a760/0x1499570 (18), R/- (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x149a760/0x149bb40 (18), -/W (disabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 149B3F0 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): Dispatching. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_message_handler] (0x4000): Received SBUS method [RegisterService] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [client_registration] (0x0100): Cancel DP ID timeout [0x149be50] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [client_registration] (0x0100): Added Frontend client [PAM] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_server_init_new_connection] (0x0200): Entering. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_server_init_new_connection] (0x0200): Adding connection 0x14a0b80. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_init_connection] (0x0200): Adding connection 14A0B80 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_add_watch] (0x2000): 0x14a11c0/0x149c0c0 (19), -/W (disabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x14a11c0/0x149c110 (19), R/- (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_server_init_new_connection] (0x0200): Got a connection (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [be_client_init] (0x0100): Set-up Backend ID timeout [0x14a1430] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 14A0B80 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x14a11c0/0x149c110 (19), R/- (disabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x14a11c0/0x149c0c0 (19), -/W (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x14a11c0/0x149c110 (19), R/- (enabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_toggle_watch] (0x4000): 0x14a11c0/0x149c0c0 (19), -/W (disabled) (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 14A0B80 (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): Dispatching. (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [sbus_message_handler] (0x4000): Received SBUS method [RegisterService] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [client_registration] (0x0100): Cancel DP ID timeout [0x14a1430] (Tue Apr 23 12:50:39 2013) [sssd[be[default]]] [client_registration] (0x0100): Added Frontend client [NSS] (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 14A0B80 (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): Dispatching. (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [sbus_message_handler] (0x4000): Received SBUS method [getDomains] (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [be_get_subdomains] (0x2000): Undefined backend target. (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 14A0B80 (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [sbus_dispatch] (0x4000): Dispatching. (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [sbus_message_handler] (0x4000): Received SBUS method [getAccountInfo] (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [be_get_account_info] (0x0100): Got request for [4097][1][name=testuser] (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [sdap_id_op_connect_step] (0x4000): beginning to connect (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [get_server_status] (0x1000): Status of server 'xx.xx.xx.xx' is 'name not resolved' (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [get_port_status] (0x1000): Port status of port <port> for server 'xx.xx.xx.xx' is 'neutral' (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 10 seconds (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [get_server_status] (0x1000): Status of server 'xx.xx.xx.xx' is 'name not resolved' (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [set_server_common_status] (0x0100): Marking server 'xx.xx.xx.xx' as 'resolving name' (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [set_server_common_status] (0x0100): Marking server 'xx.xx.xx.xx' as 'name resolved' (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [be_resolve_server_process] (0x0200): Found address for server xx.xx.xx.xx: [xx.xx.xx.xx] TTL 7200 (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [sdap_uri_callback] (0x0400): Constructed uri 'ldaps://xx.xx.xx.xx:<port>/' (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [sss_ldap_init_send] (0x4000): Using file descriptor [20] for LDAP connection. (Tue Apr 23 12:50:40 2013) [sssd[be[default]]] [sss_ldap_init_send] (0x0400): Setting 6 seconds timeout for connecting (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldaps://xx.xx.xx.xx:<port>/??base] with fd [20]. (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_rootdse_send] (0x4000): Getting rootdse (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][]. (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [*] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [altServer] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [namingContexts] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedControl] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedExtension] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedFeatures] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedLDAPVersion] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedSASLMechanisms] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [domainControllerFunctionality] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [defaultNamingContext] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [lastUSN] (Tue Apr 23 12:51:29 2013) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [highestCommittedUSN] --------------------------------------------------------------------------- To me it looks like its searching but not finding for some reason any help would be much appreciated. -Brandon

3 15

Announcing SSSD 1.9.5
by Jakub Hrozek 23 Apr '13

23 Apr '13

=== SSSD 1.9.5 === The SSSD team is proud to announce the release of version 1.9.5 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd This is mostly a bugfix release with minor feature enhancements -- see the changelog below for details. In addition to fixing functionality, this release also includes one security patch. Our focus is now on developing new features for the upcoming 1.10 release. That said, fixes for important bugs will be added to the 1.9.6 bucket and released when appropriate. The 1.9.6 release has no due date yet, although we would release it to be aligned with RHEL-6.5 at the latest. RPM packages will be made available for Fedora shortly, initially for F-18 and later also backported to F-17, which has moved to the 1.9 series recently. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * This release focused mainly on fixing regressions compared to the 1.8 series and bugfixes for features introduced in the 1.9 release cycle. The release also includes one security fix * Includes a fix for CVE-2013-0287: A simple access provider flaw prevents intended ACL use when SSSD is configured as an Active Directory client * Fixed spurious password expiration warning that was printed on login with the Kerberos back end * A new option ldap_rfc2307_fallback_to_local_users was added. If this option is set to true, SSSD is be able to resolve local group members of LDAP groups. * Fixed an indexing bug that prevented the contents of autofs maps from being returned to the automounter deamon in case the map contained a large number of entries * Several fixes for safer handling of Kerberos credential caches for cases where the ccache is set to be stored in a DIR: type == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1020 SSSD does not list local user's group membership defined in LDAP https://fedorahosted.org/sssd/ticket/1512 [sssd[krb5_child[PID]]]: Credential cache directory /run/user/UID/ccdir does not exist https://fedorahosted.org/sssd/ticket/1737 Misleading example in the man page https://fedorahosted.org/sssd/ticket/1739 sssd is not serving large automount maps reliably https://fedorahosted.org/sssd/ticket/1755 Saving dereferenced groups fails if a nested group member is outside nesting limit https://fedorahosted.org/sssd/ticket/1791 Unchecked return value in files.c https://fedorahosted.org/sssd/ticket/1795 names of domain_realm mapping files in SSSD contain dots https://fedorahosted.org/sssd/ticket/1799 sssd_be crashes sometimes https://fedorahosted.org/sssd/ticket/1808 pwd_expiration_warning has wrong default for Kerberos https://fedorahosted.org/sssd/ticket/1817 sssd pam write_selinux_login_file creating the temp file for SELinux data failed https://fedorahosted.org/sssd/ticket/1818 LDAP provider doesn't save binary attributes correctly https://fedorahosted.org/sssd/ticket/1822 krbcc dir creation issue with MIT krb5 1.11 https://fedorahosted.org/sssd/ticket/1826 sssd etas 99% CPU and runs out of file descriptors when clearing cache https://fedorahosted.org/sssd/ticket/1841 document what does access_provider=ad do https://fedorahosted.org/sssd/ticket/1868 sssd fails with readonly /etc/selinux/targeted/logins https://fedorahosted.org/sssd/ticket/1869 pam responder segfaults if the client disconnects before the operation finishes https://fedorahosted.org/sssd/ticket/1880 Simple access control always denies uppercased users in case insensitive domain == Detailed Changelog == Jakub Hrozek (16): * Bump the version to 1.9.5, reset release in RPMs to 0 * Don't use srcdir with tests * Fix the krb5 password expiration warning * Remove enumerate=true from man sssd-ldap * Don't treat 0 as default for pam_pwd_expiration warning * Provide a be_get_account_info_send function * Add unit tests for simple access test by groups * Do not compile main() in DP if UNIT_TESTING is defined * Resolve GIDs in the simple access provider * Document what does access_provider=ad do * Allocate PAM DP request data on responder context * krb5: include backwards compatible declaration of krb5_trace_info * Fix simple access group control in case-insensitive domains * LDAP: do not invalidate pointer with realloc while processing ghost users * tests: Link the simple access tests with -ldl * Updating the translations for the 1.9.5 release Jan Engelhardt (1): * sysdb: try dealing with binary-content attributes Kamil Dudka (1): * sssd-1.8.0: work around a bug in cov-build from Coverity Lukas Slebodnik (1): * Fix krbcc dir creation issue with MIT krb5 1.11 Michal Zidek (4): * Unchecked return value in files.c * File descriptor leak in nss responder. * Debug message in sss_mc_create_file. * sssd fails with readonly SELinux login files Pavel Březina (6): * krb: recreate ccache if it was deleted * subdomains: replace invalid characters with underscore in krb5 mapping file name * sdap_fill_memberships: continue if a member is not foud in sysdb * autofs: fix invalid header 'number of entries' in packet * if selinux is disabled, ignore that selogin dir is missing * krb5-utils-tests: remove invalid condition Simo Sorce (1): * ldap: Fallback option for rfc2307 schema Stephen Gallagher (2): * Fix minor grammar error in log * NSS: Add original homedir to home directory template options

1 0

Cannot convert objectsid to UNIX ID
by Russell Jones 19 Apr '13

19 Apr '13

Hi all, SSSD 1.9.2 on CentOS 6. I am attempting to configure SSSD to authenticate against AD via LDAP. When starting the daemon though, the logs get filled with failure messages about being unable to convert the SID properly for every user. The extra strange part is the SID it says it cannot convert is the same for every user. Example: (Mon Apr 15 15:52:47 2013) [sssd[be[LDAP]]] [sdap_save_user] (0x1000): Mapping user [REDACTED] objectSID to unix ID (Mon Apr 15 15:52:47 2013) [sssd[be[LDAP]]] [sdap_idmap_sid_to_unix] (0x0080): Could not convert objectSID [S-1-5-21-3220130920-4012199101-135577023-1153286127] to a UNIX ID (Mon Apr 15 15:52:47 2013) [sssd[be[LDAP]]] [sdap_save_user] (0x0040): Failed to save user [REDACTED] (Mon Apr 15 15:52:47 2013) [sssd[be[LDAP]]] [sdap_save_users] (0x0040): Failed to store user 988. Ignoring. Where can I get more information on why it's failing? The following is my sssd.conf: [sssd] domains = LDAP services = nss, pam config_file_version = 2 ;debug_level = 0x1310 [nss] filter_groups = root filter_users = root [pam] [domain/LDAP] ldap_id_use_start_tls = True id_provider = ldap chpass_provider = ldap ldap_uri = ldap://REDACTED ldap_search_base = REDACTED auth_provider = ldap cache_credentials = true ldap_schema = ad enumerate = True ldap_id_mapping = True ldap_user_objectsid = objectSid ldap_idmap_range_min = 100000 ldap_idmap_range_max = 1000000 ldap_default_bind_dn = REDACTED ldap_default_authtok_type = password ldap_default_authtok = REDACTED ldap_tls_cacertdir = /etc/sssd/cacerts debug_level = 9 ldap_force_upper_case_realm = True Also, here's what ObjectSID looks like from LDAP (via ldapsearch) for one of the users it's complaining about: objectSid:: AQUAAAAAAAUVAAAAaEzvv71MJe+/vRQI77+9RE1a77+977+9AAA= When comparing this to the other user's not being mapped, the objectSid coming from LDAP, at initial glance, is not the same.

3 9

Bug Report for 1.9.2 and 1.9.4: ldap_sudo with ldap_uri = _srv_
by Marc us 19 Apr '13

19 Apr '13

Hi, I found a bug in sssd stable 1.9.2 and 1.9.4. I found no place to report this so maybe somene here is able to help with this. The sudoers ldap lookups fail with a timeout message (see below) when using ldap_uri = _srv_ (which works with anything else i.e. ldap_users, ldap_groups, ...). This is how it looks with ldap_uri set to _srv_: (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_sudo_full_refresh_send] (0x0400): Issuing a full refresh of sudo rules (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_sudo_refresh_connect_done] (0x0400): SUDO LDAP connection successful (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_sudo_load_sudoers_next_base] (0x0400): Searching for sudo rules with base [dc=mydomain,dc=org] (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectClass=sudoRole)][dc=mydomain,dc=org]. (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoCommand] (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoHost] (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoUser] (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoOption] (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoRunAsUser] (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoRunAsGroup] (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoNotBefore] (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoNotAfter] (Thu Apr 18 20:51:03 2013) [sssd[be[MYDOMAIN]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoOrder] (Thu Apr 18 20:52:03 2013) [sssd[be[MYDOMAIN]]] [sdap_sudo_load_sudoers_process] (0x0400): Receiving sudo rules with base [dc=mydomain,dc=org] (Thu Apr 18 20:52:03 2013) [sssd[be[MYDOMAIN]]] [sdap_sudo_periodical_first_refresh_done] (0x0040): Periodical full refresh of sudo rules failed [110]: Connection timed out) For debugging I turned of ldap_sudo_use_host_filter just in case someone is wondering about the short ldap filter. With an ldap_uri set to a FQHN anything works as expected. Is there anyone who can help creating a patch for this? I have very little knowledge about the sssd source. Thanks, Marcus

2 2

Local account logins
by Sutton, Harry (GSSE) 16 Apr '13

16 Apr '13

Since getting sssd logins to work correctly, I'm noticing that logging in with my 'old' local user account takes orders of magnitude longer to complete than before. (root logins continue to happen without any noticeable delay.) Why is that, and is there a configuration parameter I can change to restore normal login times for local non-root users? I can work around the problem by opening a separate text console as root and stopping the sssd daemon until the login completes, then restarting the daemon. Ultimately, of course, I think the logical solution is to create a local sssd user (with an associated LOCAL domain), but I've grown fond of my local account user name and I'm not certain yet that I can use sss_useradd to create a local database entry with the same account name without some unintended (and perhaps negative) consequences. -- *Harry Sutton* Global Solutions Support Engineering (GSSE) GSD Customer Solution Center Technology Services, Enterprise Group

5 12

How to restrict users by GID
by Licause, Al (CSC AMS BCS - UNIX/Linux Network Support) 16 Apr '13

16 Apr '13

The following entry into an ldap.conf file on a RHEL V5 system provides for the ability to limit users based in their GID values: nss_base_passwd OU=ldap,DC=mydomain,DC=net?one?|(gidNumber=11001) (gidNumber=11003) Only those users with GID's of 11001 or 11003 can login. All others are prohibited. I've tried the same filter in sssd.conf on a v6 RHEL system but can't seem to get it to work. It doesn't cause any syntax errors but it is ignored. I've also tried placing an "=" sign after the nss_base_passwd string and quoting everything after the "=" sign....to no avail. Can anyone explain the sssd syntax for accomplishing this task ? Thanks in advance. Al Licause

3 3

sssd config for clusters
by Jason Bishop 12 Apr '13

12 Apr '13

hi errbody, i may have an easy question, but i haven't found anything in the documentation which describes my use-case exactly. i hope you can help. my environment is kerberos for authentication and kerberos using host-keytab for ldap binds. sssd is working fine for this setup. the wrinkle is that i am trying to get this to work on a (Rocks) hpc cluster where i have kerberos running on headnode but not the compute nodes. i am hoping that i can use the sssd config with kerberos authentication on the head node and have a simpler setup for the compute nodes. since ssh public keys are used for authentication on compute nodes, i really only need user and group enumeration working there. is there a simple way to get user list from sssd on head node for use on compute nodes? thank u jason

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users April 2013