On (09/08/16 19:42), Thomas Beaudry wrote:
OK well I had debug_level under [sssd] and not [pam] in my sssd.conf
file. Here is my output
The troubledhooting guide says:
Keep in mind that enabling debug_level in the [sssd] section only enables
debugging of the sssd process itself, not all the worker processes!
and BTW few mails ago I kindly ask for /var/log/sssd/sssd_$domain.log and
*_child
The attached file is just a sssd_pam.log
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [accept_fd_handler] (0x0400):
Client connected!
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Received client
version [3].
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered version
[3].
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_cmd_authenticate] (0x0100): entering
pam_cmd_authenticate
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name
'tbeaudry' matched without domain, user is tbeaudry
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): command:
SSS_PAM_AUTHENTICATE
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: not set
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): user: tbeaudry
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): service: su
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: /dev/pts/1
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: tmtg
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 0
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 6032
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): logon name: tbeaudry
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [sss_dp_issue_request] (0x0400): Issuing request
for [0x410090:3:tbeaudry@concordia.ca]
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request
for [concordia.ca][0x3][BE_REQ_INITGROUPS][1][name=tbeaudry]
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [sss_dp_internal_get_send] (0x0400): Entering
request [0x410090:3:tbeaudry@concordia.ca]
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_check_user_dp_callback] (0x0040): Unable to
get information from Data Provider
Error: 1, 11, Offline
sssd is in offline mode that main explain a lot.
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_check_user_search]
(0x0100): Requesting info for [tbeaudry(a)concordia.ca]
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_check_user_search] (0x0400): Returning info
for user [tbeaudry(a)concordia.ca]
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with
the following data:
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): command:
SSS_PAM_AUTHENTICATE
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: concordia.ca
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): user: tbeaudry
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): service: su
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: /dev/pts/1
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: tmtg
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 0
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 6032
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_print_data] (0x0100): logon name: tbeaudry
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req
returned 0
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request:
[0x410090:3:tbeaudry@concordia.ca]
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_dp_process_reply] (0x0200): received: [6
(Permission denied)][concordia.ca]
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result
[6]: Permission denied.
(Tue Aug 9 15:39:32 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 83
(Tue Aug 9 15:39:33 2016) [sssd[pam]] [client_recv] (0x0200): Client disconnected!
Any thoughts? I am going over the troubleshooting wiki now for a 3rd time.
Authentication related part[1]
-> Troubleshooting general authentication problems
1) first check in the secure log or journal if pam_sss is called at all.
DONE. (we could see it in syslog)
2) If you see the authentication request getting to the PAM responder, but
receiving an error from the back end, check the back end logs. An example
error output might look like:
@see the example of output on wiki
It contains the same error messge as in your case "Error:1, 11, Offline"
3) For Kerberos-based (that includes the IPA and AD providers) auth_provider,
look into the krb5_child.log file as well. Setting debug_level to 10 would
also enable low-level Kerberos tracing information in that logfile.
^^^^
TODO :-)
The troubleshooting wiki is not perfect. It can be considered as TL;DR.
We(developers) might overlook some parts which are not obvious for others.
So if you have some ides how to improve some parts please provide a feedback.
And now back to your issue:
Please provide sssd_$domain.log and *_child.log
LS
[1]
https://fedorahosted.org/sssd/wiki/Troubleshooting#TroubleshootingAuthent...