I’ve gotten logins to work from our AD, but for some reason after a while they just stop working again. I’m using Ubuntu 14.04.1, sssd 1.12.5.

 

I don’t know why it’s trying to contact the AD over 389. We only allow ldaps 636 connections to the AD. I’m not sure how it’s initially allowing logins and then suddenly can’t resolve the AD servers.

 

Sssd log file:

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_step] (0x4000): beginning to connect

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc01.ad.mydomain.com' is 'name resolved'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc01.ad.mydomain.com' is 'not working'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc06.ad.mydomain.com' is 'name resolved'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc06.ad.mydomain.com' is 'not working'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc04.ad.mydomain.com' is 'name resolved'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc04.ad.mydomain.com' is 'not working'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc05.ad.mydomain.com' is 'name resolved'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc05.ad.mydomain.com' is 'not working'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc02.ad.mydomain.com' is 'name resolved'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc02.ad.mydomain.com' is 'not working'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc03.ad.mydomain.com' is 'name resolved'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc03.ad.mydomain.com' is 'not working'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'cdc02.ad.mydomain.com' is 'name resolved'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'cdc02.ad.mydomain.com' is 'not working'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'cdc01.ad.mydomain.com' is 'name resolved'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'cdc01.ad.mydomain.com' is 'not working'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD'

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): attempting failover retry on op #2

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_step] (0x4000): waiting for connection to complete

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [child_sig_handler] (0x1000): Waiting for child [19728].

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [child_sig_handler] (0x0100): child [19728] finished successfully.

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_mark_offline] (0x2000): Going offline!

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_mark_offline] (0x2000): Enable check_if_online_ptask.

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_ptask_enable] (0x0400): Task [Check if online (periodic)]: enabling task

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_ptask_schedule] (0x0400): Task [Check if online (periodic)]: scheduling task 87 seconds from now [1439311309]

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #1

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_subdomains_get_conn_done] (0x0080): No AD server is available, cannot get the subdomain list while offline

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #2

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_dyndns_get_addrs_done] (0x0080): No LDAP server is available, dynamic DNS update is skipped in offline mode.

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_dyndns_update_addrs_done] (0x0040): Can't get addresses for DNS update

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158234]: Dynamic DNS update not possible while offline

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [1432158234]: Dynamic DNS update not possible while offline

(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection

(Tue Aug 11 11:40:23 2015) [sssd[be[ad.mydomain.com]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.AD.MYDOMAIN.COM], [2][No such file or directory]

 

sssd.conf

[sssd]

domains = ad.mydomain.com

config_file_version = 2

services = nss, pam

 

[nss]

#debug_level = 9

 

[domain/ad.mydomain.com]

debug_level = 9

ad_domain = ad.mydomain.com

 

id_provider = ad

auth_provider = ad

access_provider = ad

chpass_provider = ad

override_gid = 760429

#krb5_realm = AD.MYDOMAIN.COM

realmd_tags = manages-system joined-with-samba

cache_credentials = True

krb5_store_password_if_offline = True

default_shell = /bin/bash

ldap_id_mapping = False

use_fully_qualified_names = False

fallback_homedir = /home/%u

ignore_group_members = False

simple_allow_groups = Group 1, Group 2