sssd performance on large domains
by zfnoctis@gmail.com
Hi,
I'm wondering if there are any plans to improve sssd performance on large active directory domains (100k+ users, 40k+ groups), or if there are settings I am not aware of that can greatly improve performance, specifically for workstation use cases.
Currently if I do not set "ignore_group_members = True" in sssd.conf, logins can take upwards of 6 minutes and "sssd_be" will max the CPU for up to 20 minutes after logon, which makes it a non-starter. The reason I want to allow group members to be seen is that I want certain domain groups to be able to perform elevated actions using polkit. If I ignore group members, polkit reports that the group is empty and so no one can elevate in the graphical environment.
Ultimately this means that Linux workstations are at a severe disadvantage since they cannot be bound to the domain and have the normal set of access features users and IT expect from macOS or Windows.
Distributions used: Ubuntu 16.04 (sssd 1.13.4-1ubuntu1.1), Ubuntu 16.10 (sssd 1.13.4-3) and Fedora 24 (sssd-1.13.4-3.fc24). All exhibit the same problems.
I've also tried "ldap_group_nesting_level = 1" without seeing any noticeable improvement with respect to performance. Putting the database on /tmp isn't viable as these are workstations that will reboot semi-frequently, and I don't believe this is an I/O bound performance issue anyways.
Thanks for your time.
1 year, 10 months
kcm, gssproxy and klist
by Winberg Adam
With KCM and gssproxy we often see a long list of credentials when doing a 'klist':
[user.u@lxserv2114 ~]$ klist
Ticket cache: KCM:17098:66803
Default principal: user.u@AD
Valid starting Expires Service principal
01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY:
01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY:
01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY:
01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY:
01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY:
01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY:
01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY:
and so on...
The actual gssproxy credentials at /var/lib/gssproxy/clients/ does not correspond with this output, it only contains what could be expected - a TGT and maybe some service tickets.
The ever growing 'klist' list of credentials is a problem, after a while the user can no longer get any new credentials and therefore has no access to its NFS homedir (sec=krb5). I'm guessing it's the 'max_uid_ccaches' option in sssd-kcm that prevents this.
What is going on here - have we configured gssproxy/kcm wrong or is this a bug?
Regards
Adam
1 year, 11 months
sssd: AD range retrieval fails when enumeration is enabled
by R Davies
Hi,
When enumeration is enabled (required due to legacy application), and where
a group has > 1500 members, and AD's MaxValRange is at the default 1500,
then sssd fails to show more than 1500 group members. Group lookups are no
longer accurate.
A further interesting aspect is that if the sssd cache is expired (sssctl
cache-expiry -E), then the correct group membership is shown until such
time as enumeration is processed again (i.e. at most
ldap_enumeration_refresh_timeout + memcache_timeout)
src/providers/ldap/sdap.c's sdap_parse_entry() states:
/* This attribute contained range values and needs more to
> * be retrieved
> */
> /* TODO: return the set of attributes that need additional retrieval
> * For now, we'll continue below and treat it as regular values.
> */
As enumeration is enabled the subsequent ASQ/deref work is never
undertaken. As such sssd only ever processes the initial range retrieved
members (0-1499) (NB that nested groups members are evaluated).
We have looked at the relevant source code, but can't find a way to trigger
Attribute Scope Queries (ASQ)/deref. Indeed, no manner of sssd
configuration settings (other than disabling enumeration - which we sadly
cannot do) appears to change this behaviour. Increasing MaxValRange on AD
defeats the purpose of having MaxValRange.
Has anyone run into this before? Or, should I raise a new issue?
Many Thanks.
R.
2 years, 3 months
ID Views for IPA ID Views for AD users inconsistent resolution
by Louis Abel
I didn't get a response in #sssd, so I figured I'll try here at the mail list.
# rpm -q sssd ipa-server
sssd-1.16.0-19.el7_5.5.x86_64
ipa-server-4.5.4-10.el7_5.3.x86_64
I've been scratching my head trying to resolve this particular issue. I'm having issues with AD users where when they login, they'll get the UID/GID assigned in the ID views correctly, but only some of the time. Other times, they won't get the id view assigned to them. This is all done in the default trust view. What makes this issue even more interesting is that out of my 6 domain controllers, sometimes it'll be one server out of the six that does it, sometimes it's two. But it's never the same ones, so it's difficult to track the particular issue down. What's even more interesting is this is not occurring with some users (like my own). I have yet to see it occur with my account or even the rest of my team's accounts. One of the things I tried to do is delete the ID views of the offending users and recreate them to no avail.
I put SSSD into debug mode on the IPA servers and tried to get some relevant logs and such to try and figure this out. Below is my SSSD configuration, ldb info, and debug logs (removing private information where possible). I'm trying to determine if this is either a bug within SSSD or if this is a misconfiguration on my part.
$ ldbsearch -H cache_ipa.example.com.ldb name=user.name(a)ad.example.com originalADuidNumber uidNumber originalADgidNumber gidNumber
asq: Unable to register control with rootdse!
# record 1
dn: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb
originalADuidNumber: 55616902
originalADgidNumber: 55616902
uidNumber: 55616902
gidNumber: 55616902
$ ipa idoverrideuser-show "Default Trust View" user.name(a)ad.example.com
Anchor to override: user.name(a)ad.example.com
UID: 40001
GID: 40001
Home directory: /home/user.name
Login shell: /bin/bash
$ ldbsearch -H timestamps_ipa.example.com.ldb | less
dn: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb
objectCategory: user
originalModifyTimestamp: 20180823172515.0Z
entryUSN: 92632390
initgrExpireTimestamp: 1535133621
lastUpdate: 1535128235
dataExpireTimestamp: 1535133635
distinguishedName: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb
## DEBUG LOGS
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] has set [ts_cache] attrs.
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): commit ldb transaction (nesting: 0)
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching 172.20.23.190:389
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))][cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 32
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 32 timeout 6
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1080], connected[1], ops[(nil)], ldap[0x55f30a5d0f90]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a645310], ldap[0x55f30a5ce320]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [ipaanchoruuid=:SID:S-1-5-21-922099545-2851689246-2917073205-16902,cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [loginShell]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [uidNumber]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaAnchorUUID]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [gidNumber]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [homeDirectory]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaOriginalUid]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a645310], ldap[0x55f30a5ce320]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 32 finished
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_done] (0x4000): Found override for object with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [uidNumber] with [40001] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x0080): Override attribute for [gidNumber] has more [2] than one value, using only the first.
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [gidNumber] with [40001] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [homeDirectory] with [/home/user.name] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [loginShell] with [/bin/bash] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a6819a0
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a681a60
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a6819a0 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a681a60 "ltdb_timeout"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a6819a0 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [safe_original_attributes] (0x4000): Original object does not have [sshPublicKey] set.
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a683c50
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a683d10
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a683c50 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a683d10 "ltdb_timeout"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a683c50 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [uidNumber] of entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): start ldb transaction (nesting: 0)
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a68d1c0
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a68d280
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a68d1c0 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a68d280 "ltdb_timeout"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a68d1c0 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): commit ldb transaction (nesting: 0)
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] has set [cache, ts_cache] attrs.
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a68d330
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a688900
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a68d330 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a689320
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a6893e0
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a688900 "ltdb_timeout"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a68d330 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a689320 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a634920
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a6349e0
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a6893e0 "ltdb_timeout"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a689320 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a634920 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a6349e0 "ltdb_timeout"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a634920 "ltdb_callback"
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Processing group 0/1
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Fetching group S-1-5-21-922099545-2851689246-2917073205-20676
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching 172.20.23.190:389
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))][cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 33
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 33 timeout 6
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a63f270], ldap[0x55f30a5ce320]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a63f270], ldap[0x55f30a5ce320]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 33 finished
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))].
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Processing group 1/1
(Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_memberships_send] (0x0400): External group information still valid.
## /etc/sssd/sssd.conf
[domain/ipa.example.com]
cache_credentials = True
krb5_store_password_if_offline = True
# krb5_realm = IPA.EXAMPLE.COM
ipa_domain = ipa.example.com
ipa_hostname = entl01.ipa.example.com
# Server Specific Settings
ipa_server = entl01.ipa.example.com
ipa_server_mode = True
subdomain_homedir = %o
fallback_homedir = /home/%u
default_shell = /bin/bash
id_provider = ipa
auth_provider = ipa
access_provider = ipa
chpass_provider = ipa
ldap_tls_cacert = /etc/ipa/ca.crt
[sssd]
services = nss, sudo, pam, ssh
domains = ipa.example.com
[nss]
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd,tomcat,activemq,informix,oracle,xdba,grid,dbadmin,weblogic,operator,postgres,devolog
memcache_timeout = 600
homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
2 years, 4 months
p11_child doesn't use 2nd slot if 1st slot is empy
by Assaf Morami
Hello everyone.
I'm trying to configure smart card login of active directory users on an ubuntu machine.
I'm following this guide: https://scriptech.io/linux-enable-smartcard-authentication-against-active...
But for me the opensc library cannot talk with my card and I'm using a library that my card provider gave my. My issue right now is that `p11_child --pre --nssdb=/etc/pki/nssdb` fails to pull the certificate from my smart card.
I'm able to log in with AD users and their smart cards using `kinit` and `ksu`, so I know the cards are okay.
What's weird to me is that `modutil -list` shows slot 0 as empty and slot 1 as not empty, and then `p11_child --pre` doesn't try to use slot 1. Maybe p11_child thinks that if slot 0 is empty then slot 1 must be empty too?
Please help!
Here are the relevant logs:
```
# modutil -dbdir nssdb -list
Listing of PKCS #11 Modules
----------------------------------------------------
1. NSS Internal #11 Module
uri: pkcs11: library-manufacturer=Mozilla%20Foundation; library-description=NSS%20Internal%20Crypto%20Services;library
slots: 2 slots attached
status: loaded
slot: NSS Internal Cryptographic Services
token: NSS Generic Crypto Services
uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
slot: NSS User Private Key and Certificate Services
token: NSS Certificate DB
uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation; serial=0000000000000000;model=NSS%203
2. MyTest
library name: mylib.so
uri: pkcs11:library-manufacturer=Boring%20Ent.;library-description=Cryptokit%20Extended%20Version;libversion=5.3
slots: 2 slots attached
status: loaded
slot: [EMPTY]
token:
uri: pkcs11:
slot: Athena ASE IIIe (SBR069-00000) 00 00
token: 918
uri: pkcs11:token=918;manufacturer=Boring%20Ent.;serial=0349B7D30E11024G;model=PKISmartCard%20(A)
```
```
# p11_child --pre --nssdb=nssdb -d=9
[main] (0x0400): p11_child started.
[main] (0x2000): Running in [pre-auth] mode.
[main] (0x2000): Running with effective IDs: [0][0].
[do_card] (0x4000): Default Module List:
[do_card] (0x4000): common name: INSS Internal PKCS #11
[do_card] (0x4000): dll name: [(null)).
[do_card] (0x4000): common name: [MyTest]
[do_card] (0x4000): dll name: [Libsadaptor.so].
[do_card] (0x4000): Dead Module List:
[do_card] (0x4000): DB Module List:
[do_card] (ex4000): common name: [NSS Internal Module].
[do_card] (0x4000): dll name: [(null)].
[do_card] (0x4000): Description [NSS Internal Cryptographic Services Mozilla Foundation] Manufacturer [Mozilla Foundation] flags [9] removable [false] token present [true].
[do_card] (0x4000): Description [NSS User Private Key and Certificate Services Mozilla Foundation] Manufacturer [Mozilla Foundation] flags [1] removable [false] token present [true].
[do_card] (0x4000): Description [[EMPTY] Boring Ent.] Manufacturer [Boring Ent.] flags [2] removable [true] token present [false].
[do_card] (0x4000): Token not present.
[main] (0x0040): do-work failed.
[main] (Ox0020): p11_child failed!
```
2 years, 4 months
Smartcard active directory authentication in RHEL 8.3 workstation.
by Gary Letth
I'm trying to figure out how to get smartcard-authentication working in RHEL 8.3 when the computer is joined to an active directory domain. So far I've managed to configure local authentication using a smart card by mapping a specific local account to a upn in the SAN in the certificate. For obvious reasons not easy to use with a domain account. Anyone with experience on the matter?
I've followed the official RHEL guide, but the certificate on the smart card is currently not stored in the userCertificate attribute in active directory, so I really need some way to map the active directory account to the upn specified in the Subject alternate name in the certificate.
The customer is currently doing that in Windows. As long as the certificate is verified against their CA and the user name matches what's in the SAN, the user is logged on. How can I do this on a RHEL 8.3 workstation?
I tried following the official guide at Redhat, adding the user certificate to the userCertificate attribute in Active directory, but it doesn't seem to work. As soon as i use authselect to enable smartcard logon I end up with a pin prompt without entering a user name and entering the correct pin for the card doesn't work.
2 years, 6 months
[RFC] What would you like to see on sssd.io
by Pavel Březina
Dear SSSD community,
we have recently introduced new SSSD project web page at
https://sssd.io. We would like to keep adding new content, we have
plenty of ideas but we would also like to get some tips from you:
What articles would you like to see on the page? What knowledge gaps are
hard to fill with existing documentation? Feel free to suggest both user
and developer facing content.
Thanks,
Pavel
2 years, 6 months
Finding auto.master and other automount maps from non-local AD domain
by Spike White
All,
I have sssd working fine for my AD regional child domains (all have a
transitive trust). It can find users & (universal) groups from all AD
domains.
For instance, a server in amer.company.com will auto-discover non-local
child domains apac.company.com and emea.company.com.
I have this:
[sssd]
domains = amer.company.com
domain_resolution_order = amer.company.com, emea.company.com,
apac.company.com, japn.company.com, company.com
services = nss,pam,ifp,autofs
….
[domain/amer.company.com]
autofs_provider = ad
ldap_autofs_search_base = ou=automount,ou=UNIX,dc=AMER,dc=COMPANY,dc=COM
…
[domain/amer.company.com/emea.company.com]
...
In AMER, automount works great. Can find the automount maps no problem.
With the ldap_autofs_search_base above. (all our automount maps are housed
in amer AD domain).
However, we’re looking closely at an EMEA server and we realize it doesn’t
find the automount maps out of AD.
In the sssd_autofs.log file, we notice it was looking for unqualified
“auto.master”, so it converted that to auto.master(a)emea.company.com.
Whereas on an amer server, it converted that unqualified name to
auto.master(a)amer.company.com.
This gave us the idea to change /etc/auto.master from this line:
+auto.master
To this line:
+auto.master(a)amer.company.com
This seems to do better. From the sssd_autofs.log file:
(2021-05-11 20:51:25): [autofs] [sss_autofs_cmd_setautomntent] (0x0400):
Obtaining autofs map auto.master(a)amer.company.com
(2021-05-11 20:51:25): [autofs] [cache_req_set_plugin] (0x2000): CR #0:
Setting "Get autofs map" plugin
(2021-05-11 20:51:25): [autofs] [cache_req_send] (0x0400): CR #0: New
request 'Get autofs map'
(2021-05-11 20:51:25): [autofs] [cache_req_process_input] (0x0400): CR #0:
Parsing input name [auto.master(a)amer.company.com]
(2021-05-11 20:51:25): [autofs] [sss_domain_get_state] (0x1000): Domain
emea.company.com is Active
(2021-05-11 20:51:25): [autofs] [sss_domain_get_state] (0x1000): Domain
company.com is Active
(2021-05-11 20:51:25): [autofs] [sss_domain_get_state] (0x1000): Domain
japn.company.com is Active
(2021-05-11 20:51:25): [autofs] [sss_domain_get_state] (0x1000): Domain
amer.company.com is Active
(2021-05-11 20:51:25): [autofs] [sss_parse_name_for_domains] (0x0200): name
'auto.master(a)amer.company.com' matched expression for domain '
amer.company.com', user is auto.master
(2021-05-11 20:51:25): [autofs] [cache_req_set_name] (0x0400): CR #0:
Setting name [auto.master]
(2021-05-11 20:51:25): [autofs] [cache_req_select_domains] (0x0400): CR #0:
Performing a single domain search
(2021-05-11 20:51:25): [autofs] [sss_domain_get_state] (0x1000): Domain
emea.company.com is Active
(2021-05-11 20:51:25): [autofs] [sss_domain_get_state] (0x1000): Domain
amer.company.com is Active
(2021-05-11 20:51:25): [autofs] [cache_req_search_domains] (0x0400): CR #0:
Search will check the cache and check the data provider
(2021-05-11 20:51:25): [autofs] [cache_req_global_ncache_add] (0x2000): CR
#0: This request type does not support global negative cache
(2021-05-11 20:51:25): [autofs] [cache_req_process_result] (0x0400): CR #0:
Finished: Not found
(2021-05-11 20:51:25): [autofs] [client_recv] (0x0200): Client disconnected!
However, it does not find the child auto.* maps. Whereas a server in amer
does.
I would rather not have to copy my correct autofs AD structure to each
child AD domain. It’s tested and working for over a year in amer.
How can I get a non-amer server to see the automount maps?
Spike White
2 years, 6 months
Passwd fails in SSSD 2.4.2
by Paweł Szafer
Hi again,
Last week I had to change my sssd.conf to ldap_sasl_mech=GSSAPI.
SSSD is 2.4.2 on Arch Linux.
Don't know if it is related but now I can't change password with this
machine (last time it was working in February).
Anyway passwd is asking me for current password and after typing it + Enter
it returning with message: Password changed.
Error which are most important (I think) is: authentication service cannot
retrieve user authentication to the client (bold below in Polish).
What I see in logs:
pam_sss:
(2021-05-11 14:40:28): [pam] [pam_initgr_check_timeout] (0x2000): User
[test] found in PAM cache.
(2021-05-11 14:40:28): [pam] [pam_dp_send_req] (0x0100): Sending request
with the following data:
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): command:
SSS_PAM_CHAUTHTOK
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): domain: realm.domain
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): user:
test(a)realm.domain
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): service: passwd
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): tty: not set
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): ruser: not set
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): rhost: not set
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): authtok type: 1
(Password)
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): newauthtok type: 0
(No authentication token available)
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): priv: 0
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): cli_pid: 955753
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): logon name: test
(2021-05-11 14:40:28): [pam] [pam_print_data] (0x0100): flags: 4
(2021-05-11 14:40:28): [pam] [pam_dom_forwarder] (0x0100): pam_dp_send_req
returned 0
(2021-05-11 14:40:28): [pam] [sbus_dispatch] (0x4000): Dispatching.
(2021-05-11 14:40:28): [pam] [pam_dp_send_req_done] (0x0200): received: [15
(Usługa uwierzytelniania nie może uzyskać uwierzytelnienia
użytkownika)][realm.domain]
(2021-05-11 14:40:28): [pam] [ldb] (0x10000): Added timed event
"ldb_kv_callback": 0x56049f493ce0
*(2021-05-11 14:40:28): [pam] [pam_reply] (0x4000): pam_reply initially
called with result [15]: Usługa uwierzytelniania nie może uzyskać
uwierzytelnienia użytkownika. this result might be changed during
processing*
(2021-05-11 14:40:28): [pam] [filter_responses] (0x0100):
[pam_response_filter] not available, not fatal.
(2021-05-11 14:40:28): [pam] [pam_reply] (0x0200): blen: 35
*(2021-05-11 14:40:28): [pam] [pam_reply] (0x0200): Returning [15]: Usługa
uwierzytelniania nie może uzyskać uwierzytelnienia użytkownika to the
client*
(2021-05-11 14:40:28): [pam] [client_recv] (0x0200): Client disconnected!
(2021-05-11 14:40:28): [pam] [client_close_fn] (0x2000): Terminated client
[0x56049f489150][19]
(2021-05-11 14:40:33): [pam] [pam_initgr_cache_remove] (0x2000): [test]
removed from PAM initgroup cache
krb5 logs
(2021-05-11 14:40:28): [krb5_child[955777]] [main] (0x0400): krb5_child
started.
(2021-05-11 14:40:28): [krb5_child[955777]] [unpack_buffer] (0x1000): total
buffer size: [173]
(2021-05-11 14:40:28): [krb5_child[955777]] [unpack_buffer] (0x0100): cmd
[247 (password change checks)] uid [1175201116] gid [1175200513] validate
[true] enterprise principal [false] offline [false] UPN [test(a)REALM.DOMAIN]
(2021-05-11 14:40:28): [krb5_child[955777]] [unpack_buffer] (0x0100):
ccname: [FILE:/tmp/krb5cc_1175201116_XXXXXX] old_ccname:
[FILE:/tmp/krb5cc_1175201116_GlkSJ1] keytab: [/etc/krb5.keytab]
(2021-05-11 14:40:28): [krb5_child[955777]] [check_use_fast] (0x0100): Not
using FAST.
(2021-05-11 14:40:28): [krb5_child[955777]] [switch_creds] (0x0200): Switch
user to [1175201116][1175200513].
(2021-05-11 14:40:28): [krb5_child[955777]] [switch_creds] (0x0200): Switch
user to [0][0].
(2021-05-11 14:40:28): [krb5_child[955777]] [k5c_check_old_ccache]
(0x4000): Ccache_file is [FILE:/tmp/krb5cc_1175201116_GlkSJ1] and is
active and TGT is valid.
(2021-05-11 14:40:28): [krb5_child[955777]] [privileged_krb5_setup]
(0x0080): Cannot open the PAC responder socket
(2021-05-11 14:40:28): [krb5_child[955777]] [become_user] (0x0200): Trying
to become user [1175201116][1175200513].
(2021-05-11 14:40:28): [krb5_child[955777]] [main] (0x2000): Running as
[1175201116][1175200513].
(2021-05-11 14:40:28): [krb5_child[955777]] [sss_child_set_krb5_tracing]
(0x0100): krb5 tracing is not available
(2021-05-11 14:40:28): [krb5_child[955777]] [set_lifetime_options]
(0x0100): No specific renewable lifetime requested.
(2021-05-11 14:40:28): [krb5_child[955777]] [set_lifetime_options]
(0x0100): No specific lifetime requested.
(2021-05-11 14:40:28): [krb5_child[955777]] [set_canonicalize_option]
(0x0100): Canonicalization is set to [true]
(2021-05-11 14:40:28): [krb5_child[955777]] [main] (0x0400): Will perform
password change checks
(2021-05-11 14:40:28): [krb5_child[955777]] [changepw_child] (0x1000):
Password change operation
(2021-05-11 14:40:28): [krb5_child[955777]] [changepw_child] (0x0400):
Attempting kinit for realm [REALM.DOMAIN]
(2021-05-11 14:40:28): [krb5_child[955777]] [sss_krb5_responder] (0x4000):
Got question [password].
(2021-05-11 14:40:28): [krb5_child[955777]] [changepw_child] (0x2000):
chpass is not using OTP
(2021-05-11 14:40:28): [krb5_child[955777]] [changepw_child] (0x1000):
Initial authentication for change password operation successful.
(2021-05-11 14:40:28): [krb5_child[955777]] [k5c_send_data] (0x0200):
Received error code 0
(2021-05-11 14:40:28): [krb5_child[955777]] [pack_response_packet]
(0x2000): response packet size: [4]
(2021-05-11 14:40:28): [krb5_child[955777]] [k5c_send_data] (0x4000):
Response sent.
(2021-05-11 14:40:28): [krb5_child[955777]] [main] (0x0400): krb5_child
completed successfully
(2021-05-11 14:40:28): [krb5_child[955786]] [main] (0x0400): krb5_child
started.
(2021-05-11 14:40:28): [krb5_child[955786]] [unpack_buffer] (0x1000): total
buffer size: [181]
(2021-05-11 14:40:28): [krb5_child[955786]] [unpack_buffer] (0x0100): cmd
[246 (password change)] uid [1175201116] gid [1175200513] validate [true]
enterprise principal [false] offline [false] UPN [test(a)REALM.DOMAIN]
(2021-05-11 14:40:28): [krb5_child[955786]] [unpack_buffer] (0x0100):
ccname: [FILE:/tmp/krb5cc_1175201116_XXXXXX] old_ccname:
[FILE:/tmp/krb5cc_1175201116_GlkSJ1] keytab: [/etc/krb5.keytab]
(2021-05-11 14:40:28): [krb5_child[955786]] [check_use_fast] (0x0100): Not
using FAST.
(2021-05-11 14:40:28): [krb5_child[955786]] [switch_creds] (0x0200): Switch
user to [1175201116][1175200513].
(2021-05-11 14:40:28): [krb5_child[955786]] [switch_creds] (0x0200): Switch
user to [0][0].
(2021-05-11 14:40:28): [krb5_child[955786]] [k5c_check_old_ccache]
(0x4000): Ccache_file is [FILE:/tmp/krb5cc_1175201116_GlkSJ1] and is
active and TGT is valid.
(2021-05-11 14:40:28): [krb5_child[955786]] [privileged_krb5_setup]
(0x0080): Cannot open the PAC responder socket
(2021-05-11 14:40:28): [krb5_child[955786]] [become_user] (0x0200): Trying
to become user [1175201116][1175200513].
(2021-05-11 14:40:28): [krb5_child[955786]] [main] (0x2000): Running as
[1175201116][1175200513].
(2021-05-11 14:40:28): [krb5_child[955786]] [sss_child_set_krb5_tracing]
(0x0100): krb5 tracing is not available
(2021-05-11 14:40:28): [krb5_child[955786]] [set_lifetime_options]
(0x0100): No specific renewable lifetime requested.
(2021-05-11 14:40:28): [krb5_child[955786]] [set_lifetime_options]
(0x0100): No specific lifetime requested.
(2021-05-11 14:40:28): [krb5_child[955786]] [set_canonicalize_option]
(0x0100): Canonicalization is set to [true]
(2021-05-11 14:40:28): [krb5_child[955786]] [main] (0x0400): Will perform
password change
(2021-05-11 14:40:28): [krb5_child[955786]] [changepw_child] (0x1000):
Password change operation
(2021-05-11 14:40:28): [krb5_child[955786]] [changepw_child] (0x0400):
Attempting kinit for realm [REALM.DOMAIN]
(2021-05-11 14:40:28): [krb5_child[955786]] [sss_krb5_responder] (0x4000):
Got question [password].
(2021-05-11 14:40:28): [krb5_child[955786]] [changepw_child] (0x2000):
chpass is not using OTP
(2021-05-11 14:40:28): [krb5_child[955786]] [changepw_child] (0x0020):
Failed to fetch new password [2] No such file or directory.
(2021-05-11 14:40:28): [krb5_child[955786]] [k5c_send_data] (0x0200):
Received error code 1432158219
(2021-05-11 14:40:28): [krb5_child[955786]] [pack_response_packet]
(0x2000): response packet size: [4]
(2021-05-11 14:40:28): [krb5_child[955786]] [k5c_send_data] (0x4000):
Response sent.
(2021-05-11 14:40:28): [krb5_child[955786]] [main] (0x0400): krb5_child
completed successfully
Thanks in advance for your help!
-----
Best regards,
Pawel
2 years, 6 months