Faulty ldap query?
by Davor Vusir
Hello!
I'm finetuning sssd and going through the logs. We're using AD as
authentication source. SSSD is version 1.12.2 and seems to send a faulty
query to the DC:
My sAMAccountName is myLogonID but some queries passes the value of
givenName. It searches the two defined ldap_search_base twice before it
returns "No such entry". Followed by a query for "(unknown)". This query
is only once per search base. See log below.
Regards
Davor Vusir
---
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[sysdb_gpo_get_gpo_result_setting] (0x0400): key
[SeRemoteInteractiveLogonRight] value [*S-1-5-21-XXX-YYY-ZZZ-287220]
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[sysdb_gpo_get_gpo_result_setting] (0x0400): key
[SeDenyRemoteInteractiveLogonRight] value [(null)]
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[parse_policy_setting_value] (0x0400): No value for key
[SeDenyRemoteInteractiveLogonRight] found in gpo result
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): RESULTANT POLICY:
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): gpo_map_type: Remote Interactive
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): allowed_size = 1
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): allowed_sids[0] =
S-1-5-21-XXX-YYY-ZZZ-287220
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): denied_size = 0
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): CURRENT USER:
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): user_sid =
S-1-5-21-XXX-YYY-ZZZ-174590
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): group_sids[0] = S-1-5-21-XXX-YYY-ZZZ-50989
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): group_sids[1] = S-1-5-11
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): POLICY DECISION:
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): access_granted = 0
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): access_denied = 0
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_check] (0x0400): access denied: permissive mode
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[ad_gpo_access_done] (0x0400): GPO-based access control successful.
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>)
[Success]
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[be_pam_handler_callback] (0x0400): SELinux provider doesn't exist, not
sending the request to it.
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[be_pam_handler_callback] (0x0100): Sending result [0][ad.example.org]
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[be_pam_handler_callback] (0x0100): Sent result [0][ad.example.org]
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[be_req_set_domain] (0x0400): Changing request domain from
[ad.example.org] to [ad.example.org]
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler]
(0x0100): Got request with the following data
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): command: PAM_SETCRED
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): domain: ad.example.org
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): user: myLogonID
~~~~~~~~~~~~~~~ ^ ~~
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): service: sshd
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): tty: ssh
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): ruser:
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): rhost: client-1.subdomain.example.org
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): authtok type: 0
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): priv: 1
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): cli_pid: 4460
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): logon name: not set
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler]
(0x0100): Sending result [0][ad.example.org]
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[be_req_set_domain] (0x0400): Changing request domain from
[ad.example.org] to [ad.example.org]
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler]
(0x0100): Got request with the following data
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): command: PAM_OPEN_SESSION
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): domain: ad.example.org
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): user: myLogonID
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): service: sshd
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): tty: ssh
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): ruser:
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): rhost: client-1.subdomain.example.org
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): authtok type: 0
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): priv: 1
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): cli_pid: 4460
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): logon name: not set
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler]
(0x0100): Sending result [0][ad.example.org]
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]]
[be_req_set_domain] (0x0400): Changing request domain from
[ad.example.org] to [ad.example.org]
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler]
(0x0100): Got request with the following data
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): command: PAM_SETCRED
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): domain: ad.example.org
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): user: myLogonID
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): service: sshd
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): tty: ssh
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): ruser:
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): rhost: client-1.subdomain.example.org
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): authtok type: 0
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): priv: 0
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): cli_pid: 4468
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [pam_print_data]
(0x0100): logon name: not set
(Fri Aug 14 10:29:03 2015) [sssd[be[ad.example.org]]] [be_pam_handler]
(0x0100): Sending result [0][ad.example.org]
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[be_get_account_info] (0x0200): Got request for [0x1003][1][name=davor]
~~~~~~~~~~~~~~~ ^ ~~
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[be_req_set_domain] (0x0400): Changing request domain from
[ad.example.org] to [ad.example.org]
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_initgr_next_base] (0x0400): Searching for users with base
[ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org]
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(sAMAccountName=davor)(objectclass=user)(&(uidNumber=*)(!(uidNumber=0))))][ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org].
~~~~~~~~~~~~~~~ ^ ~~
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no
errmsg set
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_initgr_next_base] (0x0400): Searching for users with base
[ou=CT,dc=ad,dc=example,dc=org]
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(sAMAccountName=davor)(objectclass=user)(&(uidNumber=*)(!(uidNumber=0))))][ou=CT,dc=ad,dc=example,dc=org].
~~~~~~~~~~~~~~~ ^ ~~
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no
errmsg set
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_initgr_next_base] (0x0400): Searching for users with base
[ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org]
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(sAMAccountName=davor)(objectclass=user)(&(uidNumber=*)(!(uidNumber=0))))][ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org].
~~~~~~~~~~~~~~~ ^ ~~
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no
errmsg set
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_initgr_next_base] (0x0400): Searching for users with base
[ou=CT,dc=ad,dc=example,dc=org]
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(sAMAccountName=davor)(objectclass=user)(&(uidNumber=*)(!(uidNumber=0))))][ou=CT,dc=ad,dc=example,dc=org].
~~~~~~~~~~~~~~~ ^ ~~
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no
errmsg set
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sysdb_search_by_name] (0x0400): No such entry
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sysdb_delete_user] (0x0400): Error: 2 (No such file or directory)
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[be_get_account_info] (0x0200): Got request for [0x1001][1][name=(unknown)]
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[be_req_set_domain] (0x0400): Changing request domain from
[ad.example.org] to [ad.example.org]
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_search_user_next_base] (0x0400): Searching for users with base
[ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org]
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(sAMAccountName=\28unknown\29)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))][ou=Users,ou=Employee,ou=CompanyIDs,dc=ad,dc=example,dc=org].
~~~~~~~~~~~~~~~ ^ ~~
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no
errmsg set
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_search_user_process] (0x0400): Search for users, returned 0 results.
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_search_user_next_base] (0x0400): Searching for users with base
[ou=CT,dc=ad,dc=example,dc=org]
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(sAMAccountName=\28unknown\29)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))][ou=CT,dc=ad,dc=example,dc=org].
~~~~~~~~~~~~~~~ ^ ~~
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no
errmsg set
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_search_user_process] (0x0400): Search for users, returned 0 results.
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sdap_get_users_done] (0x0040): Failed to retrieve users
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sysdb_search_by_name] (0x0400): No such entry
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[sysdb_delete_user] (0x0400): Error: 2 (No such file or directory)
(Fri Aug 14 10:29:04 2015) [sssd[be[ad.example.org]]]
[acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
8 years, 7 months
Logins stop working
by Thackeray, Neil L
I've gotten logins to work from our AD, but for some reason after a while they just stop working again. I'm using Ubuntu 14.04.1, sssd 1.12.5.
I don't know why it's trying to contact the AD over 389. We only allow ldaps 636 connections to the AD. I'm not sure how it's initially allowing logins and then suddenly can't resolve the AD servers.
Sssd log file:
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_step] (0x4000): beginning to connect
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc01.ad.mydomain.com' is 'name resolved'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc01.ad.mydomain.com' is 'not working'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc06.ad.mydomain.com' is 'name resolved'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc06.ad.mydomain.com' is 'not working'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc04.ad.mydomain.com' is 'name resolved'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc04.ad.mydomain.com' is 'not working'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc05.ad.mydomain.com' is 'name resolved'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc05.ad.mydomain.com' is 'not working'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc02.ad.mydomain.com' is 'name resolved'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc02.ad.mydomain.com' is 'not working'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc03.ad.mydomain.com' is 'name resolved'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc03.ad.mydomain.com' is 'not working'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'cdc02.ad.mydomain.com' is 'name resolved'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'cdc02.ad.mydomain.com' is 'not working'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'cdc01.ad.mydomain.com' is 'name resolved'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'cdc01.ad.mydomain.com' is 'not working'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD'
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): attempting failover retry on op #2
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_step] (0x4000): waiting for connection to complete
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [child_sig_handler] (0x1000): Waiting for child [19728].
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [child_sig_handler] (0x0100): child [19728] finished successfully.
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_mark_offline] (0x2000): Going offline!
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_mark_offline] (0x2000): Enable check_if_online_ptask.
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_ptask_enable] (0x0400): Task [Check if online (periodic)]: enabling task
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_ptask_schedule] (0x0400): Task [Check if online (periodic)]: scheduling task 87 seconds from now [1439311309]
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #1
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_subdomains_get_conn_done] (0x0080): No AD server is available, cannot get the subdomain list while offline
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #2
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_dyndns_get_addrs_done] (0x0080): No LDAP server is available, dynamic DNS update is skipped in offline mode.
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_dyndns_update_addrs_done] (0x0040): Can't get addresses for DNS update
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158234]: Dynamic DNS update not possible while offline
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [1432158234]: Dynamic DNS update not possible while offline
(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection
(Tue Aug 11 11:40:23 2015) [sssd[be[ad.mydomain.com]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.AD.MYDOMAIN.COM], [2][No such file or directory]
sssd.conf
[sssd]
domains = ad.mydomain.com
config_file_version = 2
services = nss, pam
[nss]
#debug_level = 9
[domain/ad.mydomain.com]
debug_level = 9
ad_domain = ad.mydomain.com
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
override_gid = 760429
#krb5_realm = AD.MYDOMAIN.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = True
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u
ignore_group_members = False
simple_allow_groups = Group 1, Group 2
8 years, 7 months
sssd+ad-provider + sudo slow
by Евгений
Hi All!
Work very well with sssd+ad provider, but sudo su - very slow working when running first time(running again <1sec),
user1@host$ sudo su - ( slow ~ 8-15 sec).
user1 domain user - member of many groups (+300) in Active Directory.
/etc/sssd/sssd.conf:
[domain/default]
cache_credentials = true
ignore_group_members = true
[domain/domain.local]
debug_level = 6
id_provider = ad
ad_server = msa-dc13. domain.local, msk-dc11. domain.local
ad_domain = domain.local
ad_hostname = msa-mailsys1.domain.local
override_homedir = /home/%u
override_shell = /bin/bash
ignore_group_members = true
# FILTER
access_provider = simple
simple_allow_groups = ROL-Linux-Admin
[sssd]
services = nss, pam, sudo
cache_credentials = true
config_file_version = 2
domains = domain.local
[nss]
debug_level= 6
[pam]
[sudo]
#debug_level = 9
In /var/log/sssd/sssd_nss.log more requesting to domain,when run sudo first time.
Whether it is possible to cache operations with sudo or or some other way to get around there is the problem?
--
Eugene
8 years, 7 months
SSSD configuration database load failure
by Caleb
Hi all,
I'm trying to set up SSSD on a workstation with no success. Operating
system is fully patched Ubuntu 14.04.3
Version info:
$ sssd --version
1.11.5
sssd.conf:
[sssd]
debug_level = 0x4000
config_file_version = 2
services = nss,pam
domains = FOO
[nss]
debug_level = 0xFFF0
filter_users = root
filter_groups = root
[pam]
[domains/FOO]
debug_level = 0xFFF0
auth_provider = krb5
krb5_server = kdc.redacted.com
krb5_realm = REDACTED
cache_credentials = true
access_provider = simple
chpass_provider = krb5
id_provider = ldap
ldap_uri = ldap://ldap.redacted.com
ldap_search_base = dc=redacted,dc=com
ldap_id_use_start_tls = true
ldap_sasl_mech = GSSAPI
sudo_provider = none
sssd.conf permissions:
$ sudo ls -al /etc/sssd/sssd.conf
-rw------- 1 root root 543 Aug 9 14:30 /etc/sssd/sssd.conf
Output when run from commandline:
$ sudo /usr/sbin/sssd -i -d7
(Sun Aug 9 15:01:19:105688 2015) [sssd] [ldb] (0x0400):
server_sort:Unable to register control with rootdse!
(Sun Aug 9 15:01:19:106021 2015) [sssd] [add_implicit_services]
(0x0040): id_provider is not set for domain [FOO], trying next domain.
(Sun Aug 9 15:01:19:106120 2015) [sssd] [confdb_get_domain_internal]
(0x0010): Unknown domain [FOO]
(Sun Aug 9 15:01:19:106154 2015) [sssd] [confdb_get_domains] (0x0010):
Error (2 [No such file or directory]) retrieving domain [FOO], skipping!
(Sun Aug 9 15:01:19:106186 2015) [sssd] [confdb_get_domains] (0x0010):
No properly configured domains, fatal error!
(Sun Aug 9 15:01:19:106210 2015) [sssd] [get_monitor_config] (0x0010):
No domains configured.
(Sun Aug 9 15:01:19:106255 2015) [sssd] [main] (0x0020): SSSD couldn't
load the configuration database.
Near as I can tell, the error about a missing id_provider is a baldfaced
lie--the `id_provider = ldap` line clearly exists in sssd.conf, and this
exact configuration is working on another fully patched Ubuntu 14.04.3
system on the same network--but I haven't a clue about the error's root
cause. I'm also unable to find any information about the missing file that
is causing the `No such file or directory` error. Based on some older posts
to this list, I tried installing and running ldbsearch on
`/var/lib/sss/db/config.ldb`:
$ sudo ldbsearch -H /var/lib/sss/db/config.ldb
server_sort:Unable to register control with rootdse!
# record 1
dn: cn=sssd,cn=config
cn: sssd
config_file_version: 2
debug_level: 0x4000
domains: FOO
services: nss,pam
distinguishedName: cn=sssd,cn=config
# record 2
dn: cn=config
version: 2
lastUpdate: 1439155822
distinguishedName: cn=config
# record 3
dn: cn=nss,cn=config
cn: nss
debug_level: 0xFFF0
filter_groups: root
filter_users: root
distinguishedName: cn=nss,cn=config
# record 4
dn: cn=FOO,cn=domains,cn=config
access_provider: simple
auth_provider: krb5
cache_credentials: true
chpass_provider: krb5
cn: FOO
debug_level: 0xFFF0
id_provider: ldap
krb5_realm: REDACTED
krb5_server: kdc.redacted.com
ldap_id_use_start_tls: true
ldap_sasl_mech: GSSAPI
ldap_search_base: dc=redacted,dc=com
ldap_uri: ldap://ldap.redacted.com
sudo_provider: none
distinguishedName: cn=FOO,cn=domains,cn=config
# record 5
dn: cn=pam,cn=config
cn: pam
distinguishedName: cn=pam,cn=config
# returned 5 records
# 5 entries
# 0 referrals
config.ldb permissions:
$ ls -al /var/lib/sss/db/config.ldb
-rw------- 1 root root 1286144 Aug 9 15:16 /var/lib/sss/db/config.ldb
So that seems to be in order. I examined the source code, but wasn't able
to trace the flow of execution past `confdb_get_param`
At this point, I know of no other troubleshooting or debugging options,
even after reading through the various related documents scattered about
the Internet. Looking at file access patterns with `strace` didn't yield
any useful information either. What else could be causing this issue?
Cheers,
-Caleb
8 years, 7 months
SSSD 1.12.2 Active Directory inconsistent group membership
by Isaiah Houston
Hi,
I am having a hard time tracking down an issue with SSSD 1.12.2 on Amazon Linux (Amazon Linux only recently added SSSD to their yum repository, and 1.12.2 is the highest available version). My user can authenticate to a Samba 4 directory server, but once logged in, the “id” or “groups” command only displays the primary group, in this case the “Domain Users” group:
uid=1115600500(administrator@[domain]) gid=1115600513(domain users@[domain]) groups=1115600513(domain users@[domain])
I want additional group memberships to be displayed so I can do things like allow members of the Domain Admins group to have sudo access. Via ldapsearch, I can see that my user is correctly a member of additional groups. If I stop the sssd service, delete files in /var/lib/sss/mc and /var/lib/sss/db, and restart the service, all the groups are listed correctly:
uid=1115600500(administrator@[domain]) gid=1115600513(domain users@[domain]) groups=1115600513(domain users@[domain]),1115600512(domain admins@[domain]),1115600518(schema admins@[domain]),1115600519(enterprise admins@[domain]),1115600520(group policy creator owners@[domian]),1115600572(denied rodc password replication group@[domain])
However, as soon as I log out and log back in, the problem occurs again and persists until I repeat the process of deleting the sssd cached files and restarting sssd. This is my sssd.conf file:
[sssd]
domains = [domain]
config_file_version = 2
services = nss, pam
[domain/[domain]]
ad_domain = [domain]
krb5_realm = [domain]
realmd_tags = manages-system joined-with-samba
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = False
default_shell = /bin/bash
ldap_id_mapping = True
ldap_schema = ad
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = ad
An additional issue is that sometimes when I log in, the login process fails to complete. In the messages log, I see the following:
kernel: [344799.794025] sssd_be[13204]: segfault at 10000 ip 00007f7b73965144 sp 00007ffe53541e70 error 4 in libsss_idmap.so.0.4.0[7f7b73962000+5000]
sssd[be[domain]]: Starting up
However, this does not always happen. I am not sure if this issue is related, but since it segfaults when calling idmap I suspect they are.
Any ideas on what to do next would be appreciated!
8 years, 7 months
Map an AD group to a local group
by Domenico Viggiani
Hi,
to preserve compatibility, I'd like to map the AD users' default group to a
local Linux group.
I don't want to add every AD user to the row in /etc/group and I don't want
to change default primary group of users in AD.
Is there a group mapping function in SSSD? Or am I completely wrong?
Thanks in advance
--
Domenico Viggiani
8 years, 8 months