From: adammtemple(a)hotmail.com
To: sssd-users(a)lists.fedorahosted.org
Date: Thu, 3 Oct 2013 10:37:03 +0000
Subject: Re: [SSSD-users] authenticating against all sub-domains in AD forest
Date: Tue, 1 Oct 2013 20:43:54 +0200
From: jhrozek(a)redhat.com
To: sssd-users(a)lists.fedorahosted.org
Subject: Re: [SSSD-users] authenticating against all sub-domains in AD forest
On Sun, Sep 29, 2013 at 02:41:11PM +0100, a t wrote:
> Hi,
>
> That user, test.user, is in the subdomain
a.domain.org.
>
> Thr logs mark
domain.org as a subdomain of
b.domain.org. however, this is not
correct -
domain.org is the root domain of which
b.domain.org is a subdomain. We do not
have users in the root domain. All users are in other subdomains.
>
> I believe the user I tested in another subdomain, mhunt.test(a)a.domain.org did not
show in the logs. When I tried to log in with mhunt.test(a)a.domain.org the logs show that
sssd believes that domain "a" is a subdomain if
b.domain.org rather than another
subdomain of
domain.org.
>
> I might have to ask if I can send un-obfuscated incase I am adding in confusion!
>
> Thanks,
>
> Matthew
Interesting, I see no fatal erorr in the domain log, then. Could you
also paste the tail of /var/log/secure after the auth and also put
debug_level directive into the [pam] section as well?
If you prefer, you can send the logs directly to me without obfuscation.
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Jakub
Please see the PAM log below;
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [server_setup] (0x0400): CONFDB:
/var/lib/sss/db/config.ldb
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [confdb_get_domain_internal] (0x0400): No
enumeration for [
B.DOMAIN.ORG]!
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [confdb_get_domain_internal] (0x1000):
pwd_expiration_warning is -1
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sbus_init_connection] (0x0400): Adding connection
0x15634e0
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sbus_add_watch] (0x2000): 0x1563a10/0x155e950
(12), -/W (enabled)
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [monitor_common_send_id] (0x0100): Sending ID:
(pam,1)
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x155e580
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_names_init_from_args] (0x0100): Using re
[(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^(a)\\]+)$))].
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_fqnames_init] (0x0100): Using fq format
[%1$s@%2$s].
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_fqnames_init] (0x0100): Found the pattern for
domain name
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sbus_init_connection] (0x0400): Adding connection
0x1562880
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sbus_add_watch] (0x2000): 0x1565200/0x1562680
(13), -/W (enabled)
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [dp_common_send_id] (0x0100): Sending ID to DP:
(1,PAM)
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x15656b0
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sysdb_domain_init_internal] (0x0200): DB File for
B.DOMAIN.ORG: /var/lib/sss/db/cache_B.DOMAIN.ORG.ldb
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [ldb] (0x0400): asq: Unable to register control
with rootdse!
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_process_init] (0x0400): Responder
Initialization complete
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name
'root' matched without domain, user is root
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): using
default domain [(null)]
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_ncache_set_str] (0x0400): Adding
[
NCE/USER/B.DOMAIN.ORG/root] to negative cache permanently
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name
'root' matched without domain, user is root
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): using
default domain [(null)]
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_ncache_set_str] (0x0400): Adding
[
NCE/GROUP/B.DOMAIN.ORG/root] to negative cache permanently
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [responder_set_fd_limit] (0x0100): Maximum file
descriptors set to [8192]
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_dp_issue_request] (0x0400): Issuing request
for [0x41b4b0:domains@B.DOMAIN.ORG]
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_dp_get_domains_msg] (0x0400): Sending get
domains request for [B.DOMAIN.ORG][forced][]
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x15688b0
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sss_dp_internal_get_send] (0x0400): Entering
request [0x41b4b0:domains@B.DOMAIN.ORG]
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x15656b0
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [dp_id_callback] (0x0100): Got id ack and version
(1) from DP
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x155e580
(Thu Oct 3 14:23:50 2013) [sssd[pam]] [id_callback] (0x0100): Got id ack and version (1)
from Monitor
(Thu Oct 3 14:23:51 2013) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x15688b0
(Thu Oct 3 14:23:51 2013) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got reply from Data
Provider - DP error code: 0 errno: 0 error message: Success
(Thu Oct 3 14:23:51 2013) [sssd[pam]] [new_subdomain] (0x0400): Creating [
domain.org] as
subdomain of [
B.DOMAIN.ORG]!
(Thu Oct 3 14:23:51 2013) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request:
[0x41b4b0:domains@B.DOMAIN.ORG]
(Thu Oct 3 14:27:25 2013) [sssd[pam]] [sss_responder_ctx_destructor] (0x0400): Responder
is being shut down
Thanks,
Matthew
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users