full_name_format and supplemental groups
by Orion Poplawski
Running IPA with an AD trust. Users are in AD. Trying to use
full_name_format = %1$s to strip the domain from user names. This appears to
break supplemental groups in strange ways.
On the IPA server:
Without full_name_format:
# id orion(a)ad.nwra.com
uid=470202603(orion(a)ad.nwra.com) gid=470202603(orion(a)ad.nwra.com)
groups=470202603(orion(a)ad.nwra.com),470200513(domain
users(a)ad.nwra.com),470204703(pirep rd users(a)ad.nwra.com),470204714(wireless
access@ad.nwra.com),470204715(nwra-users@ad.nwra.com),470204701(boulder(a)ad.nwra.com),470207608(heimdall
users(a)ad.nwra.com),470200512(domain admins(a)ad.nwra.com),470207124(andreas
admins(a)ad.nwra.com)
With:
# id orion(a)ad.nwra.com
uid=470202603(orion) gid=470202603(orion) groups=470202603(orion)
If I add:
default_domain_suffix = ad.nwra.com
# id orion
uid=470202603(orion) gid=470202603(orion)
groups=470202603(orion),470200512(domain admins),470207608(heimdall
users),470204714(wireless
access),470204715(nwra-users),470204701(boulder),470204703(pirep rd
users),470207124(andreas admins),470200513(domain users)
Which I guess makes some sense as you'd need to add the domain suffix back on
to find the groups.
But this appears to completely break IPA clients (with full_name_format = %1$s
and default_domain_suffix = ad.nwra.com):
# id orion(a)ad.nwra.com
id: orion(a)ad.nwra.com: no such user
# id orion
id: orion: no such user
>From looking at the server logs, it looks like only the IPA domain is searched
If I reset the server back to normal (drop full_name_format and
default_domain_suffix):
# id orion
uid=470202603(orion) gid=470202603(orion) groups=470202603(orion)
I don't get any supplemental groups. I see sssd errors like:
(Mon Mar 30 15:20:52 2015) [sssd[be[nwra.com]]] [sysdb_mod_group_member]
(0x0400): Error: 2 (No such file or directory)
(Mon Mar 30 15:20:52 2015) [sssd[be[nwra.com]]] [sysdb_update_members_ex]
(0x0020): Could not add member [orion] to group [name=domain
admins,cn=groups,cn=nwra.com,cn=sysdb]. Skipping.
Is t trying "cn=groups,cn=nwra.com,cn=sysdb" instead of
"cn=groups,cn=ad.nwra.com,cn=sysdb"
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion(a)nwra.com
Boulder, CO 80301 http://www.nwra.com
7 years, 4 months
please do not remove enumeration from AD provider
by James Ralston
On Wed, May 6, 2015 at 4:27 AM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
> You know, just this morning, I was thinking about enumeration. It
> doesn't work for IPA views at all for example. It doesn't work for
> trusted domains at all either (except for some limited support in AD
> trusted domains that is very untested)
>
> I wonder if we could just remove enumeration from IPA and AD back
> ends in some major release.
Please don't do this.
Enumeration is a very useful feature. It allows us to do things like
this:
$ getent passwd | grep -i lastname
The equivalent ldapsearch command is much more tedious:
$ ldapsearch -z 0 -E pr=2147483647/noprompt -o ldif-wrap=no -L -L -H
'ldap:///dc%3Dexample%2Cdc%3Dorg -Y GSSAPI -N -b "dc=example,dc=org"
"(&(objectClass=user)(cn=*lastname*))" dn cn sAMAccountName
More generically, enumeration is the way Unix/Linux has always worked.
Even getting users to change from:
grep -i lastname /etc/passwd
To this:
getent passwd | grep -i lastname
...has been a struggle.
We also have various services that (unfortuantely) pre-load the passwd
and group files at startup by enumerating them with getpwent_r() and
getgrent_r(), instead of using the get*nam_r() and get*id_r()
functions as-needed. These services break outright if enumeration is
disabled.
(Yes, these services are broken. Yes, they shouldn't do that. But our
ability to fix them is extremely limited at best, because we don't
control them.)
Finally, we have many systems that cannot be joined to Active
Directory (for policy reasons, not technical reasons). But we want to
use the same passwd/group entries on those systems as returned by sssd
on hosts that are joined to Active Directory. We do this by scraping
the output of "getent -s sss passwd" and "getent -s sss group" and
manually merging it into the local passwd and group files
(respectively) on these hosts.
> It's just a legacy feature, so those who need it can fall back to
> the LDAP provider..
But the LDAP provider doesn't support ID mapping; only the AD provider
does. And ID mapping is the main reason we use sssd.
I'm not asking you to make enumeration the default. It shouldn't be;
it should be something you only turn on if you need it, and you KNOW
you need it. But if you need it, you NEED it. Please don't take it
away.
8 years, 1 month
AD site recognition with sssd version 1.11.5
by Ondrej Valousek
Hi List,
I am just trying to run sssd on Ubuntu 14.04 and it seems to be unable to detect the proper AD site it belongs to.
The thing is, that in order to detect the proper site, it needs to connect to some (random) AD controller first.
In our scenario, the box is only allowed to connect to the controller that belongs to the current AD site. Everything else is blocked by the firewall.
So what happens is:
1. Sssd starts
2. DNS SRV lookup for the dns domain discovers 15 domain controllers
3. SSSD tries randomly (couple of them) connect them - one by one
4. If we are unlucky, none of the first 1-2 controllers found belongs to the current site
5. SSSD bails out with timeout, marking the whole AD backend offline
The solution would probably be to connect all of them at once or extend the timeout after each attempt.
What do you think?
Ondrej
-----
The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.
8 years, 8 months
Re: [SSSD-users] Unexpected result from ldap: Referral(10), 0000202B: RefErr: DSID-0310082F
by Carl Pettersson (BN)
> No, it's a bug in SSSD.
>
> 6.6 is already quite old in SSSD terms, could you please try a newer
> version from this COPR repo?
> https://copr.fedoraproject.org/coprs/lslebodn/sssd-1-12/
>
> 1.12.5 is more-or-less equivalent to what 6.7 will include..
Thanks! I installed that version, and now I get a different error:
(Wed Jun 24 20:21:26 2015) [sssd[be[AD.EXAMPLE.COM]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: MACHINE$
(Wed Jun 24 20:21:26 2015) [sssd[be[AD.EXAMPLE.COM]]] [sasl_bind_send] (0x0020): ldap_sasl_bind failed (-2)[Local error]
(Wed Jun 24 20:21:26 2015) [sssd[be[AD.EXAMPLE.COM]]] [sasl_bind_send] (0x0080): Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)]
(Wed Jun 24 20:21:26 2015) [sssd[be[AD.EXAMPLE.COM]]] [child_sig_handler] (0x1000): Waiting for child [22372].
(Wed Jun 24 20:21:26 2015) [sssd[be[AD.EXAMPLE.COM]]] [child_sig_handler] (0x0100): child [22372] finished successfully.
(Wed Jun 24 20:21:26 2015) [sssd[be[AD.EXAMPLE.COM]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'foo-ad02.a.foo.com' as 'not working'
(I hope this gets threaded properly, I didn't get the reply to my mailbox, but read your answer on the archive web)
Best regards,
Carl
8 years, 8 months
caching question? (switching servers)
by Janelle
Hello,
My first post here. I have an issue with having occasional failures of
LDAP servers being used by SSSD. What happens is that when a new server
is stood up to replace the failed servers, users can't seem to login
until SSSD is restarted. Some users can, and it is hard to tell which
can and can't. I understand this is a caching setting or has something
to do with caching, but I don't fully understand why sssd can't just
keep running. Prior to this we used nslcd and never had these issues.
Is this a known issue or am I missing something in the setup?
Thank you
~Janelle
8 years, 8 months
Unexpected result from ldap: Referral(10), 0000202B: RefErr: DSID-0310082F
by Carl Pettersson (BN)
Hi,
We're getting this referral related error in our sssd installation. Some environment information:
* CentOS 6.6 clients, sssd v1.11.6
* Windows 2012R2 domain controllers, 2008R2 functional level, single domain forest. Let's call it ad.example.com.
* We have one-way trusts to several other domains/forests, a.foo,com, b.bar.com and c.baz.com
We've joined the clients with adcli, and we can successfully authenticate with accounts from the ad.example.com domain. It is also possible to
kinit myuser(a)A.FOO.COM
but this fails:
getent passwd myuser(a)a.foo.com
Looking at the logs (after setting debug_level=8), I can see this error message:
(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_process_result] (0x2000): Trace: sh[0xda3140], connected[1], ops[0xda1480], ldap[0xda3720]
(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0400): Search result: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points
ref 1: 'a.foo.com'
(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points
ref 1: 'a.foo.com'
(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [5]: Input/output error
(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_users_done] (0x0040): Failed to retrieve users
(There's also a row slightly after, "[ad_account_info_complete] (0x0010): Bug: dp_error is OK on failed request", unclear if this is related, or actually a separate bug)
I first interpreted this as indicating that I needed to allow referral chasing, but when I turn that on (via ldap_referrals = true), but aside from taking much longer, it still errors:
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_process_result] (0x2000): Trace: sh[0xe4b9b0], connected[1], ops[0xe4c540], ldap[0xe50a40]
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://a.foo.com/dc=a,dc=foo,dc=com] with fd [25].
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error]
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://a.foo.com/dc=a,dc=foo,dc=com].
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0400): Search result: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points
ref 1: 'a.foo.com'
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points
ref 1: 'a.foo.com'
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [5]: Input/output error
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_users_done] (0x0040): Failed to retrieve users
I also suspected networking issues a while, but a Windows client on the same subnet can authenticate fine (we only do subnet filtering in our firewalls).
Here are my configuration files:
sssd.conf:
[sssd]
services = nss, pam, ssh, autofs
config_file_version = 2
domains = AD.EXAMPLE.COM
[nss]
override_homedir = /home/%d/%u
override_shell = /bin/bash
[domain/AD.EXAMPLE.COM]
debug_level = 8
id_provider = ad
use_fully_qualified_names = TRUE
krb5.conf:
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = AD.EXAMPLE.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
# I found documentation indicating that these should be commented out while troubleshooting
# Commenting in/out does not seem to affect the problem, however.
[realms]
# AD.EXAMPLE.COM = {
# kdc = ad102.ad.example.com
# kdc = ad201.ad.example.com
# admin_server = ad201.ad.example.com
# }
[domain_realm]
# .ad.example.com = AD.EXAMPLE.COM
# ad.example.com = AD.EXAMPLE.COM
What have we done wrong?
Best regards,
Carl
8 years, 9 months
TLS problem (Certificate extension not found)
by Chris Lajoie
I'm trying to set up openldap + pam + sssd and everything seems to be
working except sssd is not able to use TLS to communicate with my ldap
server.
When I use ldap_auth_disable_tls_never_use_in_production=True,
everything works.
Here are the relevant log messages:
(Mon Jun 22 10:50:04 2015) [sssd[be[default]]] [sdap_sys_connect_done]
(0x0100): Executing START TLS
(Mon Jun 22 10:50:04 2015) [sssd[be[default]]] [sdap_connect_done]
(0x0080): START TLS result: Success(0), (null)
(Mon Jun 22 10:50:04 2015) [sssd[be[default]]] [sdap_connect_done]
(0x0080): ldap_install_tls failed: [Connect error] [TLS error
-8157:Certificate extension not found.]
There's not much to be found on google, except this promising RHKB entry
that requires a subscription to see the solution.
https://access.redhat.com/solutions/185883
Can someone tell me what this error is supposed to be telling me about
what's wrong with my certificate?
Chris
8 years, 9 months
SSSD and Dynamic DNS - clarification
by Frank Pikelner
Hello,
In my testing it would appear for Dynamic DNS to work (update DNS A and PTR
records), the Linux client hostsname needs to be FQDN (client123.domain.com)
defined as one of the hostnames in /etc/hosts for the 127.0.0.1 IP as:
[/etc/hosts]
127.0.0.1 client123.domain.com client123 localhost.local
localhost
172.16.5.10 client123.domain.com client123
If I have something like, dynamic DNS does not appear to work:
[/etc/hosts]
127.0.0.1 localhost.local localhost
172.16.5.10 client123.domain.com client123
The second /etc/hosts file should be correct but dynamic DNS is not
working. Is there something in the implementation that requires the first
case, or should just the order of the /etc/hosts entries modified so that
the localhost appears second in the list?
Frank
8 years, 9 months
[ding-libs] Announcing DING-LIBS 0.5.0
by Pavel Reichl
The SSSD team is proud to announce the 0.5.0 release of ding-libs
utility library.
It can be downloaded from
https://fedorahosted.org/sssd/wiki/Releases#DING-LIBSReleases
== Highlights ==
=== libini_config ===
* This release adds an API to create, modify and save INI files
* Merging configuration snippets installed in different locations is supported
=== libcollection ===
* New functions: `col_get_dup_item`, `col_delete_item_with_cb`, `col_remove_item_with_cb`
== Note for distribution packagers ==
* New public header file `ini_cofigmod.h`
* API and ABI is backward compatible with last release (0.4.0)
== Detailed Changelog ==
Dmitri Pal (22):
* Print info when array is empty
* Declaring new internal access check function
* Refactored access control check
* New function to merge snippets
* Test file for unit test
* [INI] Make the merge function build
* Function to return one of the dups
* Allow to modify item name
* Expose delete with callback function
* Comment creation helper
* Comment can be NULL
* Move definition to common header
* Fix wrapping error
* New interface to modify configuration
* Build new interface
* Generate doxy doc for INI modification API
* Cleaning doxygen comments
* Change order of the headers
* New interface to save configuration in a file
* Implementation of the interface to save configuration
* Unit test for the save interface
* Build new tests for the save interface
Lukas Slebodnik (10):
* SPEC: Use correct soname for packages lib{collection,ini_config}
* SPEC: Do not include compiled files into package libdhash-devel
* ini_config_ut: enable verbose mode with env variable
* collection: Add new function col_remove_item_with_cb
* INI: Fix memory leak with INI_VA_CLEAN
* COLLECTION: Return the last duplicate for big index
* INI: Fix adding string with INI_VA_MODADD_E and big index
* INI: Add check based test ini_configmod_ut_check
* Bump version-info
* Update versions before 0.5.0 release
8 years, 9 months