-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 06/02/2015 01:20 AM, Jakub Hrozek wrote:
On Mon, Jun 01, 2015 at 11:11:51AM -0600, Erinn Looney-Triggs
wrote:
> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
>
> This may or may not be related to FreeIPA, but it definitely is
> related to SSSD, so I reckoned I would start here.
>
> I have two FreeIPA servers, after a password change for my
> account, one FreeIPA server works with the new password, and the
> other only works with the old password.
>
> However, kinit works fine on both, and if I understand all the
> moving parts correctly a kinit is going to go against the KDC on
> the respective IPA server, which backs into LDAP, yadda yadda, in
> short my password IS changed on both, it is not a sync issue (I
> believe), but SSSD is flunking out.
>
> Now I have run a debug session for SSSD and I THINK the following
> is the relevant part:
>
> (Mon May 18 18:57:52 2015) [sssd[be[example.com]]]
> [sasl_bind_send] (0x0100): Exe cuting sasl bind mech: GSSAPI,
> user:
host/ipa2.example.com (Mon May 18 18:57:53 2015)
> [sssd[be[example.com]]] [sasl_bind_send] (0x0020): ldap_sasl_bind
> failed (49)[Invalid credentials]
I think this just means the keytab is wrong, can you kinit with
the keytab (kinit -k) ?
Yep, works without issue.
I think the simplest way to fix the problem is fetch a new one or
re-enroll the client.
> (Mon May 18 18:57:53 2015) [sssd[be[example.com]]]
> [sasl_bind_send] (0x0080): Extended failure message: [SASL(-14):
> authorization failure: mech ANONYMOUS is too weak]
I'm suprised that 1) the code carried on with anonymous bind and
that 2) anonymous bind is not allowed with IPA, did you harden the
server?
I have hardened the server to disallow anonymous binds:
nsslapd-allow-anonymous-access: rootdse
The setting is same on both the working and non-working IPA servers.
>
> Now I haven't tracked all this down, but I figured I would ask
> while I was looking it all up, lest anyone have any great ideas.
>
> Why one IPA server is working and the other isn't, well, clearly
> there must be a config difference, but I am not sure what it is
> yet.
_______________________________________________ sssd-users mailing
list sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Thanks,
- -Erinn
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBCAAGBQJVbjhMAAoJEFg7BmJL2iPOoScIAKHZpVPKHK1hFr5Wr5+oa2n7
YD3Avr4GayaU1gnWd9tcYMq6OmeO96Cq+voP5UzQj1dFosMXmg7PrCyyndRuhIoY
VUFqk6KwxJ8KAz2Qp7uo2kMUH47AmjOgPDLzCck2FBJDhMZCjQg93xXB+uqVGK/H
EgJ7AnebjZwjHUKBAG8N0cC2EnEXfjyiDEm4vBmBNvGPbRCFw4H12Dye8ezuHZJH
L80fnnMZ9iX2QxeDocAUk85KSvnhOyrUvhDIwU8cWCi01qoUswZgUnYZ29XBvRYR
PZzuwtBQxvxg7qJWWD+ctyDLMff/T/7p4u1fmJp+aTwkh1I2Lb5p0rSn5v4v6eg=
=VAzo
-----END PGP SIGNATURE-----