FreeIPA public demo available
by Martin Kosek
Hello all FreeIPA users and enthusiasts!
I would like to invite everyone to try our new public FreeIPA demo instance
running on Red Hat OpenStack platform:
http://www.freeipa.org/page/Demo
The demo will always hold the latest stable version of FreeIPA or a Beta
version of a next major release (e.g. when 4.0 Beta is available).
The demo is great for:
* Testing changes and enhancements in the most recent CLI/Web UI/API
* Testing integration in the OS - FreeIPA clients can be enrolled
* Testing web applications with LDAP/Kerberos authentication and advanced
integration with FreeIPA
You can read all the details in the page referred above.
Feedback welcome!
--
Martin Kosek <mkosek(a)redhat.com>
Supervisor, Software Engineering - Identity Management Team
Red Hat Inc.
9 years, 10 months
Announcing SSSD 1.11.6
by Jakub Hrozek
=== SSSD 1.11.6 ===
The SSSD team is proud to announce the release of version 1.11.6 of
the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd
RPM packages will be made available for Fedora 19 and 20 shortly.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights ==
* This release focuses on delivering bug fixes and a subset of the DBus
interface from 1.12.
* A new responder, called InfoPipe was added. This responder provides a
public D-Bus interface accessible over the system bus. In this release,
only methods for retrieving user attributes and list of groups were
added. The full interface is being developed in the 1.12 series. The
primary consumer if this interface subset are Apache modules such as
mod_lookup_identity or mod_intercept_form_submit
* Fixed bug in the AD responder that caused crashes when authenticating
as a user from a trusted domain to a system enrolled to a trusted
domain other than the forest root
* A potential crash on timeout in the autofs client library was fixed.
* Several patches that improve portability of SSSD, especially with
consideration of BSD systems have been included
== Packaging Changes ==
* The InfoPipe responder is packaged in its own subpackage
== Documentation Changes ==
* The new InfoPipe responder has several configuration options. Refer to
the sssd-ifp manual page for details.
* The LDAP provider has a new option ldap_user_extra_attrs that enables the
administrator to extend the map of attributes downloaded when looking up
a user. These custom attributes can then be retrieved with the new DBus API.
* A new pam_sss option ignore_authinfo_unavail was added. Setting this
option makes pam_sss return PAM_IGNORE when SSSD is not running instead
of PAM_AUTHINFO_UNAVAIL. This option is mostly useful for BSD systems.
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/1853
[RFE] Allow sssd to replace macro (ie. %H) with value specified in
config file
https://fedorahosted.org/sssd/ticket/2114
refresh_expired_interval man page doc is not clear
https://fedorahosted.org/sssd/ticket/2294
In sssd.conf, setting "ldap_group_nesting_level = 0" does not appear
to work
https://fedorahosted.org/sssd/ticket/2305
SSSD Crashes when storage experiences high latency
https://fedorahosted.org/sssd/ticket/2312
Fails to start in interactive mode when stdin isn't a pts device
https://fedorahosted.org/sssd/ticket/2322
segfault in sssd_be when cross forest users are queried
https://fedorahosted.org/sssd/ticket/2333
Expanding home directory fails when the request comes from the PAC
responder
https://fedorahosted.org/sssd/ticket/2334
Simple access fails to look up primary group when using sssd-ad until
running the id command.
== Detailed Changelog ==
Alexander Bokovoy (1):
* ipa subdomains provider: make sure search by SID works for homedir
Benjamin Franzke (1):
* BUILD: Link libsss_krb5_common.so to libkeyutils.so
Jakub Hrozek (36):
* Updating the version for the 1.11.6 development
* LDAP: Check the LDAP handle before using it
* AD: Do not remove non-root domains when looking up root domain
* Remove duplicate declaration
* UTIL: Move sss_parse_name_for_domains declaration to util.h
* IFP: Fix a typo in the Makefile
* IFP: Re-add the InfoPipe? server
* IFP: Connect to the system bus
* TESTS: Create a default sss_names_ctx in create_dom_test_ctx
* TESTS: Split a separate common_mock_resp_dp module
* RESPONDERS: Add a new request sss_parse_inp_send
* LDAP: Fix off-by-one bug in sdap_copy_opts
* LDAP: Make it possible to extend an attribute map
* AD: Initialize user_map_cnt in server mode
* Add a unit test for sss_parse_name_for_domains
* SBUS: Generate introspection from the interface meta structure
* SBUS: Create an sbus_method_meta instance for Introspection
* IFP: Close memstream handle in introspect destructor
* SBUS: several trivial style fixes
* SBUS: Fix error handling condition
* SBUS: Add a convenience function sbus_error_new
* SBUS: Split out dbus_conn_send
* SBUS: Add SBUS_CONN_TYPE_SYSBUS
* SBUS: Add an async request to retrieve the caller ID
* SBUS: Refactor sbus_message_handler to retrieve caller ID
* IFP: Add utility functions
* IFP: use a list of allowed_uids for authentication
* IFP: Initialize negative cache timeout
* IFP: Add GetUserAttrs? call
* IFP: Per-attribute ACL for users
* SYSDB: return SYSDB_NAME from sysdb_initgroups
* IFP: Add a GetGroupsList? method
* MAN: Add sssd-ifp to the list of translatable manual pages
* BUILD: Disable dbus tests when running distcheck
* Updating the translations for the 1.11.6 release
* Updating the translations again for the 1.11.6 release
Lukas Slebodnik (38):
* AUTOMAKE: Do not include generated files into tarball
* UTIL: Use constant instead of value for stdin.
* MONITOR: Fix start up with empty standard input
* BUILD: Make samba4 libraries optional
* BUILD: Explicitly link libsss_ad.so with sasl libs
* sss_autofs: Check return value of autofs make request
* sss_autofs: Do not try to free empty autofs context
* man: Substitute entity values for entity references
* TEST: Some macros aren't defined in older version of check.
* TEST: Link ipa_ldap_opt test with openldap libs
* UTIL: Add function sss_parse_name_const
* NSS: Refactor expand_homedir_template
* NSS: Add option to expand homedir template format
* TEST: Add test for expand homedir
* SPEC: Remove duplicate sssd_ifp.
* SBUS: Fix warning declaration shadows a global declaration
* Remove unused parameter from ifp_user_get_attr_handle_reply
* Remove unused parameter from ifp_user_get_groups_reply
* resolv: Do not try to free addrinfo in case of error
* CONFIGURE: Remove duplicate detection of pam
* CRYPTO: Use unprefixed version of function stpncpy
* PAM: macro PAM_DATA_REPLACE isn't available in openpam.
* PAM: Fix problem with missing declaration.
* UTIL: Fix order of header files.
* LDAP: Don't use macro _XOPEN_SOURCE for extra features
* PAM: add ignore_authinfo_unavail option
* SDAP: Use portable constant as level in setsockopt
* PAM: Include header file security/pam_appl.h
* MAKE: Remove PAM libraries from libsss_simple
* CONFIGURE: Enhance detection of pam
* PAM: Fix compilation of pam_test_client with openpam
* PAM: Use fallback version of some pam macros
* PAM: Define compatible macros for some functions.
* SBUS: Define DBUS_ERROR_INIT for old version of dbus
* SBUS: Include config.h for enabling function in stdio.h
* Unify usage of function gethostname
* MAN: Add reference to manual page sssd-sudo
* KRB: Prevent dereference of a null pointer
Nikolai Kondrashov (12):
* Add cscope inverted index files to .gitignore
* Move DEBUG macro body to debug_fn
* Remove extra flushing from debug message output
* Cleanup debug_fn
* Make DEBUG macro definition variadic
* Make DEBUG macro invocations variadic
* Fixup DEBUG macro invocations update
* Update DEBUG* invocations to use new levels
* Update debug levels in sss_semanage_error_callback
* Update debug level in sysdb_check_upgrade_02
* Remove DEBUG macro support for old debug levels
* build: Switch to AM_DISTCHECK_CONFIGURE_FLAGS
Pavel Březina (6):
* man: clarify refresh_expired_interval
* IFP: do not create client socket
* tests: add confdb_path to sss_test_ctx
* sbus_tests: fix missing invoker in initializer
* sbus request: fix error initialization
* SBUS: remove unused variables
Pavel Reichl (10):
* SDAP: augmented logging for group saving
* AD Provider: bug-fix uninitialized variable
* AD Provider: bugfix use-after-free
* SYSDB: augmented logging when adding new group
* LDAP: fix - find primary group by gid
* MAN: Detailed ldap_group_nesting_level option
* SDAP: Make nesting_level = 0 to ignore nested groups
* SDAP: Add option to disable use of Token-Groups
* refactor calls of sss_parse_name
* TEST: Remove unused variable
Stef Walter (13):
* sbus: Add meta data structures and code generator
* sbus: Add sbus_vtable and update codegen to support it
* nss: Stop using one DBus interface with totally different methods
* sbus: Rework sbus to use interface metadata and vtables
* sbus: Generate constants from interface definitions
* sbus: Use constants to make dbus calls
* sbus: Add struct sbus_request to represent a DBus invocation
* sbus: Refactor how we export DBus interfaces
* sbus: Make sbus_new_server() work for non-priveleged processes
* sbus_tests: Add some testing of dispatch and handler code
* sbus: Add the sbus_request_parse_or_finish() method
* sbus: Add type-safe DBus method handlers and finish functions
* sbus_codegen_tests: Add test case type-safe handler args
Sumit Bose (1):
* Make LDAP extra attributes available to IPA and AD
9 years, 10 months
timeout and offline mode behaviour
by "Thomas B. Rücker"
Hi,
we're using SSSD in combination with active directory and have received
complaints from users about a corner case in our setup.
Our AD servers are only reachable from within our corporate network,
connection attempts from the outside are dropped by firewalls. This
leads to the following scenario:
- user takes machine (e.g. laptop) outside the corporate network
- user tries to authenticate (or in some cases also tries to "ls" which
causes uid/gid lookup)
- sssd will try to reach the configured servers for up to 30s
- sssd goes (back) into offline mode and uses cached credentials and
authenticates the user
This will however NOT happen if sssd gets told by the IP stack that a
connection to the target IP is not possible (e.g. "ip route add
blackhole 192.0.2.23/32" or one of the routers along the way generates
an ICMP unreachable). In such cases sssd will go immediately into
offline mode and use cached credentials.
I'm aware that this is over all sensible behaviour, but what I would
hope to fine tune is how sssd stays in offline mode. Currently it seems
like it will leave offline mode when it tries to reconnect (hardcoded
30s?). That leads to a flip flop scenario where it seems to be 30s
offline and 30s "online/connecting" and users have a fairly high chance
to hit a time during which their authentication will seemingly stall.
So my question is:
Is there a better way to deal with this in the sssd context?
If not we'll probably have to implement separate connection checking and
inject and remove blackhole routes accordingly. Not the nicest of
workarounds in my book.
Thanks, cheers
Thomas
PS: We're using sssd on many distributions, but our main distro at the
moment is ubuntu 12.04 with sssd 1.8.6 and we'll be rolling out 14.04 in
addition, which has sssd 1.11.3.
9 years, 10 months
Re: [SSSD-users] timeout and offline mode behaviour
by Joschi Brauchle
> On 06/02/2014 07:51 AM, John Hodrien wrote:
> > On Mon, 2 Jun 2014, Stephen Gallagher wrote:
> >
> >> This is the real problem. If SSSD can route to the IP address,
> >> then we have to proceed assuming that the LDAP server should be
> >> available (thereby attempting to connect to it and perform
> >> online authentication). There's really no way to determine ahead
> >> of time whether the service is "supposed" to be available.
> >>
> >> You may want to play with the option 'ldap_opt_timeout' (see
> >> sssd-ldap(5)). It controls how long the OpenLDAP client libraries
> >> will wait for a response (in your case, how long it will wait
> >> while the packets are dropped. It defaults to 6s).
> >
> > This should be a one off hit though, right? If I discover the
> > LDAP server is offline, I should remember this, admittedly recheck
> > periodically, but never cause another delay waiting for it to
> > spring back into life. Given the way some of these laptops are
> > used, I'd even quite like to configure it to default to this
> > state.
> >
> > When I last tried this (which was a while ago) these delays would
> > happen repeatedly, so the setup was unusable, and I had to ditch
> > sssd on the laptop.
>
> Well, in most common cases, the LDAP server is unresolvable when not
> on the VPN/inside the network, so SSSD immediately detects that it
> can't get there and the delay is unnoticeable.
>
> It's those cases where the server is addressable but unresponsive that
> is much harder to handle.
>
> Right now, we have a two-minute sleep between operations trying to go
> online again. (I think I saw a patch go in for 1.12 that makes this
> configurable). That's mostly so that we catch cases where you've
> connected to the VPN but for one reason or another SSSD doesn't get
> notified that the network state changed (there are lots of edge-cases
> that cause this).
I am not 100% sure that the LDAP server being unresponsive is the
cause... Once I have the logs I will know more!
But isn't this is design flaw of the LDAP connectivity test?
If connectivity is tested only after some application/the system is
requesting information from SSSD and the server is unresponsive, this
causes a long and unpleasant delay if the request is kept pending until
the connection times out.
Hence, I'd suggest that SSSD periodically tests the LDAP connection in
the background (or after network state change) *without* an actual
request triggering this. As long as the LDAP server is unreachable or
unresponsive, SSSD should stay in offline mode and answer requests right
away with cached results.
Joschi Brauchle
9 years, 10 months
1.12 beta can't authenticate
by steve
Hi
can kinit OK but pam doesn't allow us in it seems.
Any ideas?
Thanks
Steve
--- --- ---
openSUSE 13.1
make install of beta build over a working 1.11.5.1
Here is a domain user:
id steve2
uid=3000021(steve2) gid=20513(domain users) grupos=20513(domain
users),21111(staff2)
steve2 can authenticate and su fine with 1.11.5.1 on the same client
pam:
auth required pam_env.so
auth optional pam_gnome_keyring.so
auth sufficient pam_unix.so try_first_pass
auth required pam_sss.so use_first_pass
client log:
2014-05-31T16:25:27.738959+02:00 catral su: pam_unix(su:auth):
authentication failure; logname=steve uid=1000 euid=0 tty=pts/1
ruser=steve rhost= user=steve2
2014-05-31T16:25:29.102746+02:00 catral su: pam_sss(su:auth):
authentication success; logname=steve uid=1000 euid=0 tty=pts/1
ruser=steve rhost= user=steve2
2014-05-31T16:25:29.164275+02:00 catral su: pam_sss(su:account): Access
denied for user steve2: 4 (Error del sistema)
sssd -i -d7:
2014-05-31T16:25:07.537030+02:00 catral sssd: Starting up
2014-05-31T16:25:07.854951+02:00 catral sssd[be[hh3.site]]: Starting up
2014-05-31T16:25:09.645973+02:00 catral sssd[pam]: Starting up
2014-05-31T16:25:09.665278+02:00 catral sssd[nss]: Starting up
2014-05-31T16:25:09.702723+02:00 catral sssd[autofs]: Starting up
(Sat May 31 16:25:24 2014) [sssd[nss]] [accept_fd_handler] (0x0400):
Client connected!
(Sat May 31 16:25:24 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200):
Received client version [1].
(Sat May 31 16:25:24 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200):
Offered version [1].
(Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0400):
Running command [17] with input [steve2].
(Sat May 31 16:25:24 2014) [sssd[nss]] [sss_parse_name_for_domains]
(0x0200): name 'steve2' matched without domain, user is steve2
(Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0100):
Requesting info for [steve2] from [<ALL>]
(Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getpwnam_search]
(0x0100): Requesting info for [steve2(a)hh3.site]
(Sat May 31 16:25:24 2014) [sssd[nss]] [check_cache] (0x0400): Cached
entry is valid, returning..
(Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getpwnam_search]
(0x0400): Returning info for user [steve2(a)hh3.site]
(Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0400):
Running command [17] with input [steve2].
(Sat May 31 16:25:24 2014) [sssd[nss]] [sss_parse_name_for_domains]
(0x0200): name 'steve2' matched without domain, user is steve2
(Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0100):
Requesting info for [steve2] from [<ALL>]
(Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getpwnam_search]
(0x0100): Requesting info for [steve2(a)hh3.site]
(Sat May 31 16:25:24 2014) [sssd[nss]] [check_cache] (0x0400): Cached
entry is valid, returning..
(Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getpwnam_search]
(0x0400): Returning info for user [steve2(a)hh3.site]
(Sat May 31 16:25:27 2014) [sssd] [service_send_ping] (0x0100): Pinging
hh3.site
(Sat May 31 16:25:27 2014) [sssd] [ping_check] (0x0100): Service
hh3.site replied to ping
(Sat May 31 16:25:27 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0400):
Running command [17] with input [steve2].
(Sat May 31 16:25:27 2014) [sssd[nss]] [sss_parse_name_for_domains]
(0x0200): name 'steve2' matched without domain, user is steve2
(Sat May 31 16:25:27 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0100):
Requesting info for [steve2] from [<ALL>]
(Sat May 31 16:25:27 2014) [sssd[nss]] [nss_cmd_getpwnam_search]
(0x0100): Requesting info for [steve2(a)hh3.site]
(Sat May 31 16:25:27 2014) [sssd[nss]] [check_cache] (0x0400): Cached
entry is valid, returning..
(Sat May 31 16:25:27 2014) [sssd[nss]] [nss_cmd_getpwnam_search]
(0x0400): Returning info for user [steve2(a)hh3.site]
(Sat May 31 16:25:27 2014) [sssd[pam]] [accept_fd_handler] (0x0400):
Client connected!
(Sat May 31 16:25:27 2014) [sssd[pam]] [sss_cmd_get_version] (0x0200):
Received client version [3].
(Sat May 31 16:25:27 2014) [sssd[pam]] [sss_cmd_get_version] (0x0200):
Offered version [3].
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_cmd_authenticate] (0x0100):
entering pam_cmd_authenticate
(Sat May 31 16:25:27 2014) [sssd[pam]] [sss_parse_name_for_domains]
(0x0200): name 'steve2' matched without domain, user is steve2
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100):
command: PAM_AUTHENTICATE
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100):
domain: not set
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): user:
steve2
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100):
service: su
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): tty:
pts/1
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser:
steve
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost:
not set
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100):
authtok type: 1
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok type: 0
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): priv:
0
(Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100):
cli_pid: 2423
(Sat May 31 16:25:27 2014) [sssd[pam]] [sss_dp_issue_request] (0x0400):
Issuing request for [0x8054300:3:steve2@hh3.site]
(Sat May 31 16:25:27 2014) [sssd[pam]] [sss_dp_get_account_msg]
(0x0400): Creating request for [hh3.site][3][1][name=steve2]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [be_get_account_info]
(0x0100): Got request for [3][1][name=steve2]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [be_req_set_domain]
(0x0400): Changing request domain from [hh3.site] to [hh3.site]
(Sat May 31 16:25:27 2014) [sssd[pam]] [sss_dp_internal_get_send]
(0x0400): (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[fo_resolve_service_send] (0x0100): Entering request
[0x8054300:3:steve2@hh3.site]
Trying to resolve service 'AD_GC'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_server_status]
(0x1000): Status of server 'hh16.hh3.site' is 'working'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_port_status]
(0x1000): Port status of port 0 for server 'hh16.hh3.site' is 'neutral'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_server_status]
(0x1000): Status of server 'hh16.hh3.site' is 'working'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[be_resolve_server_process] (0x1000): Saving the first resolved server
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[be_resolve_server_process] (0x0200): Found address for server
hh16.hh3.site: [192.168.1.16] TTL 7200
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [ad_resolve_callback]
(0x0100): Constructed uri 'ldap://hh16.hh3.site'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [ad_resolve_callback]
(0x0100): Constructed GC uri 'ldap://hh16.hh3.site:3268'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sss_ldap_init_send]
(0x0400): Setting 6 seconds timeout for connecting
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldap://hh16.hh3.site:3268/??base] with fd [18].
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=*)][].
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [*]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [altServer]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [namingContexts]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[supportedControl]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[supportedExtension]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[supportedFeatures]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[supportedLDAPVersion]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[supportedSASLMechanisms]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[domainControllerFunctionality]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[defaultNamingContext]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [lastUSN]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[highestCommittedUSN]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no
errmsg set
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility
level to [4]
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_kinit_send]
(0x0400): Attempting kinit (/etc/krb5.keytab, CATRAL$, HH3.SITE, 86400)
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_kinit_next_kdc]
(0x1000): Resolving next KDC for service AD
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_server_status]
(0x1000): Status of server 'hh16.hh3.site' is 'working'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_port_status]
(0x1000): Port status of port 0 for server 'hh16.hh3.site' is 'working'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_server_status]
(0x1000): Status of server 'hh16.hh3.site' is 'working'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[be_resolve_server_process] (0x1000): Saving the first resolved server
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[be_resolve_server_process] (0x0200): Found address for server
hh16.hh3.site: [192.168.1.16] TTL 7200
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [ad_resolve_callback]
(0x0100): Constructed uri 'ldap://hh16.hh3.site'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [ad_resolve_callback]
(0x0100): Constructed GC uri 'ldap://hh16.hh3.site'
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[sdap_kinit_kdc_resolved] (0x1000): KDC resolved, attempting to get
TGT...
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]]
[create_tgt_req_send_buffer] (0x0400): buffer size: 47
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [set_tgt_child_timeout]
(0x0400): Setting 6 seconds timeout for tgt child
(Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [write_pipe_handler]
(0x0400): All data has been sent!
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [main] (0x0400):
ldap_child started.
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer]
(0x1000): total buffer size: 47
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer]
(0x1000): realm_str size: 8
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer]
(0x1000): got realm_str: HH3.SITE
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer]
(0x1000): princ_str size: 7
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer]
(0x1000): got princ_str: CATRAL$
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer]
(0x1000): keytab_name size: 16
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer]
(0x1000): got keytab_name: /etc/krb5.keytab
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer]
(0x1000): lifetime: 86400
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]]
[ldap_child_get_tgt_sync] (0x0100): Principal name is: [CATRAL
$(a)HH3.SITE]
(Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]]
[ldap_child_get_tgt_sync] (0x0100): Using keytab [/etc/krb5.keytab]
(Sat May 31 16:25:28 2014) [sssd] [service_send_ping] (0x0100): Pinging
nss
(Sat May 31 16:25:28 2014) [sssd] [service_send_ping] (0x0100): Pinging
pam
(Sat May 31 16:25:28 2014) [sssd] [service_send_ping] (0x0100): Pinging
autofs
(Sat May 31 16:25:28 2014) [sssd] [ping_check] (0x0100): Service autofs
replied to ping
(Sat May 31 16:25:28 2014) [sssd] [ping_check] (0x0100): Service pam
replied to ping
(Sat May 31 16:25:28 2014) [[sssd[ldap_child[2424]]]] [prepare_response]
(0x0400): (Sat May 31 16:25:28 2014) [sssd] [ping_check] (0x0100):
Service nss replied to ping
Building response for result [0]
(Sat May 31 16:25:28 2014) [[sssd[ldap_child[2424]]]] [pack_buffer]
(0x1000): result [0] krberr [0] msgsize [46] msg
[FILE:/usr/local/var/lib/sss/db/ccache_HH3.SITE]
(Sat May 31 16:25:28 2014) [[sssd[ldap_child[2424]]]] [main] (0x0400):
ldap_child completed successfully
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [read_pipe_handler]
(0x0400): EOF received, client finished
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_tgt_recv]
(0x0400): Child responded: 0
[FILE:/usr/local/var/lib/sss/db/ccache_HH3.SITE], expired on
[1401582327]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_cli_auth_step]
(0x0100): expire timeout is 900
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_cli_auth_step]
(0x1000): the connection will expire at 1401547228
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sasl_bind_send]
(0x0100): Executing sasl bind mech: gssapi, user: CATRAL$
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [child_sig_handler]
(0x1000): Waiting for child [2424].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [child_sig_handler]
(0x0100): child [2424] finished successfully.
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [fo_set_port_status]
(0x0100): Marking port 0 of server 'hh16.hh3.site' as 'working'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[set_server_common_status] (0x0100): Marking server 'hh16.hh3.site' as
'working'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [ad_user_data_cmp]
(0x1000): Comparing GC with GC
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [fo_set_port_status]
(0x0400): Marking port 0 of duplicate server 'hh16.hh3.site' as
'working'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_initgr_next_base] (0x0400): Searching for users with base
[DC=hh3,DC=site]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(sAMAccountName=steve2)(objectclass=user)(&(uidNumber=*)(!(uidNumber=0))))][DC=hh3,DC=site].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[unixUserPassword]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[unixHomeDirectory]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[userPrincipalName]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [name]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectGUID]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [primaryGroupID]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [whenChanged]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[userAccountControl]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no
errmsg set
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_save_user]
(0x0400): Save user
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_primary_name]
(0x0400): Processing object steve2
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_save_user]
(0x0400): Processing user steve2
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_save_user]
(0x0400): Adding original memberOf attributes to [steve2].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_save_user]
(0x0400): Adding user principal [steve2(a)HH3.SITE] to attributes of
[steve2].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_save_user]
(0x0400): Storing info for user steve2
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [no
filter][CN=steve2,CN=Users,DC=hh3,DC=site].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [tokenGroups]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no
errmsg set
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_ad_tokengroups_initgr_posix_tg_done] (0x1000): Processing
membership SID [S-1-5-21-451355595-2219208293-2714859210-1111]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_ad_tokengroups_initgr_posix_tg_done] (0x1000): Processing
membership SID [S-1-5-21-451355595-2219208293-2714859210-513]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_ad_tokengroups_initgr_posix_tg_done] (0x1000): Processing
membership SID [S-1-5-32-545]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_ad_tokengroups_initgr_posix_tg_done] (0x0080): Domain not found
for SID S-1-5-32-545
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[sdap_ad_tokengroups_update_members] (0x1000): Updating memberships for
[steve2]
(Sat May 31 16:25:28 2014) [sssd[nss]] [nss_memcache_initgr_check]
(0x1000): Got request for [steve2(a)hh3.site]
(Sat May 31 16:25:28 2014) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got
reply from Data Provider - DP error code: 0 errno: 0 error message:
Success
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_check_user_search] (0x0100):
Requesting info for [steve2(a)hh3.site]
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_check_user_search] (0x0400):
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [acctinfo_callback]
(0x0100): Request processed. Returned 0,0,Success
Returning info for user [steve2(a)hh3.site]
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_dp_send_req] (0x0100):
Sending request with the following data:
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100):
command: PAM_AUTHENTICATE
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100):
domain: hh3.site
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): user:
steve2
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100):
service: su
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): tty:
pts/1
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser:
steve
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost:
not set
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100):
authtok type: 1
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok type: 0
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): priv:
0
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100):
cli_pid: 2423
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [be_req_set_domain]
(0x0400): Changing request domain from [hh3.site] to [hh3.site]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [be_pam_handler]
(0x0100): Got request with the following data
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): command: PAM_AUTHENTICATE
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): domain: hh3.site
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): user: steve2
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): service: su
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): tty: pts/1
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): ruser: steve
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): rhost:
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): authtok type: 1
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): priv: 0
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): cli_pid: 2423
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [krb5_pam_handler]
(0x1000): Wait queue of user [steve2] is empty, running request
immediately.
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [switch_creds] (0x0200):
Switch user to [3000021][20513].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [switch_creds] (0x0200):
Switch user to [0][0].
(Sat May 31 16:25:28 2014) [sssd[pam]] [pam_dom_forwarder] (0x0100):
pam_dp_send_req returned 0
(Sat May 31 16:25:28 2014) [sssd[pam]] [sss_dp_req_destructor] (0x0400):
Deleting request: [0x8054300:3:steve2@hh3.site]
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [get_server_status]
(0x1000): Status of server 'hh16.hh3.site' is 'working'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [get_port_status]
(0x1000): Port status of port 0 for server 'hh16.hh3.site' is 'working'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [get_server_status]
(0x1000): Status of server 'hh16.hh3.site' is 'working'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[be_resolve_server_process] (0x1000): Saving the first resolved server
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[be_resolve_server_process] (0x0200): Found address for server
hh16.hh3.site: [192.168.1.16] TTL 7200
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [ad_resolve_callback]
(0x0100): Constructed uri 'ldap://hh16.hh3.site'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [ad_resolve_callback]
(0x0100): Constructed GC uri 'ldap://hh16.hh3.site'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [write_pipe_handler]
(0x0400): All data has been sent!
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [main] (0x0400):
krb5_child started.
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [unpack_buffer]
(0x1000): total buffer size: [106]
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [unpack_buffer]
(0x0100): cmd [241] uid [3000021] gid [20513] validate [true] enterprise
principal [true] offline [false] UPN [steve2(a)HH3.SITE]
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [unpack_buffer]
(0x0100): ccname: [FILE:/tmp/krb5cc_3000021] keytab: [/etc/krb5.keytab]
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]]
[set_lifetime_options] (0x0100): Cannot read
[SSSD_KRB5_RENEWABLE_LIFETIME] from environment.
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]]
[set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from
environment.
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]]
[set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to
[true]
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [k5c_setup]
(0x0100): Not using FAST.
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [main] (0x0400):
Will perform online auth
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [tgt_req_child]
(0x1000): Attempting to get a TGT
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [get_and_save_tgt]
(0x0400): Attempting kinit for realm [HH3.SITE]
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [validate_tgt]
(0x0400): TGT verified using key for [host/catral.hh3.site(a)HH3.SITE].
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [sss_send_pac]
(0x0040): sss_pac_make_request failed [-1][2].
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [validate_tgt]
(0x0040): sss_send_pac failed, group membership for user with principal
[steve2\@HH3.SITE(a)HH3.SITE] might not be correct.
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [become_user]
(0x0200): Trying to become user [3000021][20513].
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [k5c_send_data]
(0x0200): Received error code 0
(Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [main] (0x0400):
krb5_child completed successfully
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [read_pipe_handler]
(0x0400): EOF received, client finished
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[parse_krb5_child_response] (0x1000): child response [0][3][36].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[parse_krb5_child_response] (0x1000): child response
[0][-1073741822][16].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[parse_krb5_child_response] (0x1000): child response
[0][-1073741823][32].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[parse_krb5_child_response] (0x1000): TGT times are
[1401546329][1401546329][1401582329][1401632728].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [fo_set_port_status]
(0x0100): Marking port 0 of server 'hh16.hh3.site' as 'working'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[set_server_common_status] (0x0100): Marking server 'hh16.hh3.site' as
'working'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [ad_user_data_cmp]
(0x1000): Comparing LDAP with LDAP
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [fo_set_port_status]
(0x0400): Marking port 0 of duplicate server 'hh16.hh3.site' as
'working'
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [switch_creds] (0x0200):
Switch user to [3000021][20513].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [switch_creds] (0x0200):
Switch user to [0][0].
(Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]]
[safe_remove_old_ccache_file] (0x0400): New and old ccache file are the
same, none will be deleted.
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [check_wait_queue]
(0x1000): Wait queue for user [steve2] is empty.
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>)
[Success]
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[be_pam_handler_callback] (0x0100): Sending result [0][hh3.site]
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_dp_process_reply] (0x0100):
received: [0][hh3.site]
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_reply] (0x0200): pam_reply
called with result [0].
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_reply] (0x0200): blen: 69
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[be_pam_handler_callback] (0x0100): (Sat May 31 16:25:29 2014)
[sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input
[steve2].
(Sat May 31 16:25:29 2014) [sssd[nss]] [sss_parse_name_for_domains]
(0x0200): name 'steve2' matched without domain, user is steve2
(Sat May 31 16:25:29 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0100):
Requesting info for [steve2] from [<ALL>]
(Sat May 31 16:25:29 2014) [sssd[nss]] [nss_cmd_getpwnam_search]
(0x0100): Requesting info for [steve2(a)hh3.site]
(Sat May 31 16:25:29 2014) [sssd[nss]] [check_cache] (0x0400): Cached
entry is valid, returning..
(Sat May 31 16:25:29 2014) [sssd[nss]] [nss_cmd_getpwnam_search]
(0x0400): Returning info for user [steve2(a)hh3.site]
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_cmd_acct_mgmt] (0x0100):
Sent result [0][hh3.site]
entering pam_cmd_acct_mgmt
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [child_sig_handler]
(0x1000): (Sat May 31 16:25:29 2014) [sssd[pam]]
[sss_parse_name_for_domains] (0x0200): Waiting for child [2425].
name 'steve2' matched without domain, user is steve2
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): (Sat
May 31 16:25:29 2014) [sssd[be[hh3.site]]] [child_sig_handler] (0x0100):
command: PAM_ACCT_MGMT
child [2425] finished successfully.
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
domain: not set
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): user:
steve2
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
service: su
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): tty:
pts/1
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser:
steve
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost:
not set
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
authtok type: 0
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok type: 0
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): priv:
0
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
cli_pid: 2423
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_check_user_search] (0x0100):
Requesting info for [steve2(a)hh3.site]
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_check_user_search] (0x0400):
Returning info for user [steve2(a)hh3.site]
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_dp_send_req] (0x0100):
Sending request with the following data:
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
command: PAM_ACCT_MGMT
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
domain: hh3.site
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): user:
steve2
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
service: su
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): tty:
pts/1
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser:
steve
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost:
not set
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
authtok type: 0
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok type: 0
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): priv:
0
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100):
cli_pid: 2423
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [be_req_set_domain]
(0x0400): Changing request domain from [hh3.site] to [hh3.site]
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [be_pam_handler]
(0x0100): Got request with the following data
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): command: PAM_ACCT_MGMT
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): domain: hh3.site
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): user: steve2
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): service: su
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): tty: pts/1
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): ruser: steve
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): rhost:
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): authtok type: 0
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): priv: 0
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data]
(0x0100): cli_pid: 2423
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [sdap_access_send]
(0x0400): Performing access check for user [steve2]
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[sdap_account_expired_ad] (0x0400): Performing AD access check for user
[steve2]
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [ad_gpo_connect_done]
(0x0400): sam_account_name is catral.hh3.site$
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(objectclass=user)(sAMAccountName=catral.hh3.site
$))][dc=hh3,dc=site].
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[distinguishedName]
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[userAccountControl]
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_dom_forwarder] (0x0100):
pam_dp_send_req returned 0
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no
errmsg set
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[ad_gpo_target_dn_retrieval_done] (0x0040): No DN retrieved for policy
target.
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [ad_gpo_access_done]
(0x0040): GPO-based access control failed.
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[be_pam_handler_callback] (0x0100): Backend returned: (3, 4, No existe
el fichero o el directorio) [Internal Error (Error del sistema)]
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[be_pam_handler_callback] (0x0100): Sending result [4][hh3.site]
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_dp_process_reply] (0x0100):
received: [4][hh3.site]
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_reply] (0x0200): pam_reply
called with result [4].
(Sat May 31 16:25:29 2014) [sssd[pam]] [pam_reply] (0x0200): blen: 25
(Sat May 31 16:25:29 2014) [sssd[pam]] [client_recv] (0x0200): Client
disconnected!
(Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]]
[be_pam_handler_callback] (0x0100): Sent result [4][hh3.site]
(Sat May 31 16:25:32 2014) [sssd[nss]] [client_recv] (0x0200): Client
disconnected!
^C(Sat May 31 16:25:35 2014) [sssd] [monitor_quit_signal] (0x0040):
Monitor received Interrupción: terminating children
(Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0040): Returned
with: 0
(Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Terminating
[autofs][2413]
(Sat May 31 16:25:35 2014) [sssd[autofs]] [sss_responder_ctx_destructor]
(0x0400): Responder is being shut down
(Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [sbus_dispatch]
(0x0080): Connection is not open for dispatching.
(Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [be_client_destructor]
(0x0400): Removed autofs client
(Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Child
[autofs] terminated with a signal
(Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Terminating
[pam][2412]
(Sat May 31 16:25:35 2014) [sssd[pam]] [sss_responder_ctx_destructor]
(0x0400): Responder is being shut down
(Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [sbus_dispatch]
(0x0080): Connection is not open for dispatching.
(Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [be_client_destructor]
(0x0400): Removed PAM client
(Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Child [pam]
terminated with a signal
(Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Terminating
[nss][2411]
(Sat May 31 16:25:35 2014) [sssd[nss]] [sss_responder_ctx_destructor]
(0x0400): Responder is being shut down
(Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [sbus_dispatch]
(0x0080): Connection is not open for dispatching.
(Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [be_client_destructor]
(0x0400): Removed NSS client
(Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Child [nss]
terminated with a signal
(Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Terminating
[hh3.site][2410]
(Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [remove_krb5_info_files]
(0x0200): Could not remove
[/usr/local/var/lib/sss/pubconf/kpasswdinfo.HH3.SITE], [2][No existe el
fichero o el directorio]
(Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [be_ptask_destructor]
(0x0400): Terminating periodic task [Cleanup of hh3.site]
(Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Child
[hh3.site] terminated with a signal
sssd.conf
[sssd]
services = nss, pam, autofs
config_file_version = 2
domains = hh3.site
[nss]
[pam]
[autofs]
[domain/hh3.site]
ad_hostname = catral.hh3.site
ad_server = hh16.hh3.site
ad_domain = hh3.site
ldap_schema = ad
id_provider = ad
access_provider = ad
auth_provider = ad
chpass_provider = ad
ldap_id_mapping=false
ldap_sasl_mech = gssapi
ldap_sasl_authid = CATRAL$(a)HH3.SITE
krb5_keytab = /etc/krb5.keytab
ldap_krb5_init_creds = true
autofs_provider=ldap
ldap_autofs_search_base = OU=automount,DC=hh3,DC=site
ldap_autofs_map_object_class = automountMap
ldap_autofs_entry_object_class = automount
ldap_autofs_map_name = automountMapName
ldap_autofs_entry_key = automountKey
ldap_autofs_entry_value = automountInformation
KDC
Kerberos: AS-REQ steve2\@HH3.SITE(a)HH3.SITE from ipv4:192.168.1.25:39732
for krbtgt/HH3.SITE(a)HH3.SITE
Kerberos: Client sent patypes: 149
Kerberos: Looking for PKINIT pa-data -- steve2\@HH3.SITE(a)HH3.SITE
Kerberos: Looking for ENC-TS pa-data -- steve2\@HH3.SITE(a)HH3.SITE
Kerberos: No preauth found, returning PREAUTH-REQUIRED -- steve2
\@HH3.SITE(a)HH3.SITE
Kerberos: AS-REQ steve2\@HH3.SITE(a)HH3.SITE from ipv4:192.168.1.25:56942
for krbtgt/HH3.SITE(a)HH3.SITE
Kerberos: Client sent patypes: encrypted-timestamp, 149
Kerberos: Looking for PKINIT pa-data -- steve2\@HH3.SITE(a)HH3.SITE
Kerberos: Looking for ENC-TS pa-data -- steve2\@HH3.SITE(a)HH3.SITE
Kerberos: ENC-TS Pre-authentication succeeded -- steve2
\@HH3.SITE(a)HH3.SITE using arcfour-hmac-md5
9 years, 10 months