sssd-users May 2026

sssd-users@lists.fedorahosted.org

5 participants
3 discussions

Trouble joining a forest - error on root domain
by Marco Gaiarin 19 Jun '26

19 Jun '26

I've tried to join an Ubuntu machine (22.04, latest upgrade applied) to our domain, composed of a root domain (ad.myshortdomain.it) and 4 other domain (lom.ad.myshortdomain.it, ven.ad.myshortdomain.it, fvg.ad.myshortdomain.it, pug.ad.myshortdomain.it), in a forest. I've joined the ubuntu box to one of the subdomain (ven.ad.myshortdomain.it). Join worked as expected, but i was not able to authenticate. I catch error like: [...] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [be_resolve_server_process] (0x0200): [RID#6] Found address for server lnfdc2.ad.myshortdomain.it: [10.7.5.22] TTL 2115 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_kinit_kdc_resolved] (0x1000): [RID#6] KDC resolved, attempting to get TGT... [...] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0100): [RID#6] Executing sasl bind mech: GSS-SPNEGO, user: CNL-RICERCA$ * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x4000): [RID#6] SASL: GSSAPI client step 1 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x4000): [RID#6] SASL: GSSAPI client step 1 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x0040): [RID#6] SASL: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0020): [RID#6] ldap_sasl_interactive_bind_s failed (-2)[Local error] (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_cli_connect_recv] (0x0040): [RID#6] Unable to establish connection [1432158227]: Authentication Failed ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0020): [RID#6] ldap_sasl_interactive_bind_s failed (-2)[Local error] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0080): [RID#6] Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x1000): [RID#6] Waiting for child [3942]. * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x0100): [RID#6] child [3942] finished successfully. * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_cli_connect_recv] (0x0040): [RID#6] Unable to establish connection [1432158227]: Authentication Failed ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 14:22:48): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x0020): [RID#6] waitpid did not found a child with changed status. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [_be_fo_set_port_status] (0x8000): [RID#6] Setting status: PORT_NOT_WORKING. Called from: ../src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_recv: 2125 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [fo_set_port_status] (0x0100): [RID#6] Marking port 389 of server 'lnfdc2.ad.myshortdomain.it' as 'not working' * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [fo_set_port_status] (0x0400): [RID#6] Marking port 389 of duplicate server 'lnfdc2.ad.myshortdomain.it' as 'not working' * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_handle_release] (0x2000): [RID#6] Trace: sh[0x61ee25d7b110], connected[1], ops[(nil)], ldap[0x61ee25d7aa80], destructor_lock[0], release_memory[0] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [remove_connection_callback] (0x4000): [RID#6] Successfully removed connection callback. and i was forced to limit access to subdomain, adding in /etc/sssd/sssd.conf: ad_enabled_domains = ven.ad.myshortdomain.it After that, still i catch errors that prevent me to open sessions, like: * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_get_generic_op_finished] (0x0400): [RID#5] Search result: Referral(10), 0000202B: RefErr: DSID-0310079D, data 0, 1 access points ref 1: 'ad.myshortdomain.it' * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_get_generic_ext_add_references] (0x1000): [RID#5] Additional References: ldap://ad.myshortdomain.it/cn=%7BA66B11F6-4E7E-42F7-A0C0-B1548B3378B7%7D,cn=policies,cn=system,DC=ad,DC=lnf,DC=it * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_op_destructor] (0x2000): [RID#5] Operation 21 finished * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sss_domain_get_state] (0x1000): [RID#5] Domain ven.ad.myshortdomain.it is Active * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_send] (0x0020): [RID#5] Could not find domain matching [ad.myshortdomain.it] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#5] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile) ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x0200): [RID#5] communication error on cached connection, moving to next server * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x4000): [RID#5] advising for connection retry #1 * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x4000): [RID#5] releasing operation connection * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_release_conn_data] (0x4000): [RID#5] Releasing unused connection with fd [20] * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_handle_release] (0x2000): [RID#5] Trace: sh[0x58cb6cdc3bc0], connected[1], ops[(nil)], ldap[0x58cb6cdc2c10], destructor_lock[0], release_memory[0] * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [remove_connection_callback] (0x4000): [RID#5] Successfully removed connection callback. * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#5] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile) ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_som_attrs_done] (0x0040): [RID#11] no attrs found for SOM; try next SOM * ... skipping repetitive backtrace ... (2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_send] (0x0020): [RID#11] Could not find domain matching [ad.myshortdomain.it] * ... skipping repetitive backtrace ... (2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#11] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile) * ... skipping repetitive backtrace ... (2026-05-22 15:48:13): [be[ven.ad.myshortdomain.it]] [sbus_issue_request_done] (0x0040): sssd.dataprovider.pamHandler: Error [1432158213]: Terminated (2026-05-22 15:48:13): [be[ven.ad.myshortdomain.it]] [sbus_issue_request_done] (0x0040): sssd.dataprovider.pamHandler: Error [1432158213]: Terminated seems to me related to GPO, still of the root domain; i was forced to add also to /etc/sssd/sssd.conf: ad_gpo_access_control = disabled ad_gpo_ignore_unreadable = True ad_gpo_default_right = permit What is wrong on my setup? Thanks. --

4 11

Unable to resolve gid from sibling domain
by Tech Burgher 29 May '26

29 May '26

Hello -- one of the customers we work with is unable to resolve gid from a silbing domain. When we run the id command, we see 4294967295 returned for some of the groups. Based on AI analysis, it suggests that, the "Forest Root Is Required for Complete Subdomain Discovery" and the "Global Catalog Is Required for Cross-Domain Group Memberships". It is recommending the sssd.conf be defined with the root domain, and the subdomains be inferred, via discovery. This is only an extract, but the current sssd.conf provides no mention of the root domain, only the domains that the accounts belong to: ############################################################ # DOMAIN: domain1.foo.com ############################################################ [domain/domain1.foo.com] ad_server = _srv_ id_provider = ad auth_provider = ad access_provider = ad ad_domain = domain1.foo.com subdomains_provider = ad ldap_id_mapping = False krb5_store_password_if_offline = True filter_users = root filter_groups = root ignore_group_members = True subdomain_inherit = ignore_group_members ############################################################ # DOMAIN: domain2.foo.com ############################################################ [domain/domain2.foo.com] ad_server = _srv_ id_provider = ad auth_provider = ad access_provider = ad ad_domain = domain2.foo.com subdomains_provider = ad ldap_id_mapping = False krb5_store_password_if_offline = True filter_users = root filter_groups = root ignore_group_members = True subdomain_inherit = ignore_group_members It is proposing this change: [domain/foo.com] id_provider = ad auth_provider = ad access_provider = ad ad_domain = foo.com subdomains_provider = ad # discovers domain1, domain2 automatically ldap_id_mapping = False krb5_store_password_if_offline = True filter_users = root filter_groups = root ignore_group_members = True subdomain_inherit = ignore_group_members Does the proposal sound reasonable given the observed behavior? Thank you for your time.

2 1

kscreenlocker fails on the first attempt to unlock with pam_sss error
by Marek Greško 04 May '26

04 May '26

Hello, some time ago the users started to observe strange issue. When they try to unlock the kscreenlocker after switching consoles by Atl+Fx key even the type correct password, it fails and this is found in the logs: kscreenlocker_greet[109438]: pam_sss(kde:auth): received for user username: 4 (Chyba systému), which means system error. I cannot see any other log with more details on this. The second attempt works. It is hard to say when the issue started, because longer time we were thinking users just type wrong password. We are going to elaborate more on this. We are unsure whether the console switching is the necessary condition or only waiting for longer time is sufficient. Apparently when I try to unlock after several minutes, it works on a first attempt. Thanks Marek

1 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users May 2026