On Wed, Feb 01, 2017 at 01:29:31PM -0000,
namanth(a)gmail.com wrote:
Thank you, this was helpful. Please check the UPN attribute value of
this user. As a workaround, please try setting:
ldap_user_principal = nosuchattribute
to force SSSD into ignoring the UPN.
> (Tue Jan 31 14:48:41 2017) [sssd[be[bsclogon.buffalostate.edu]]] [check_wait_queue]
(0x1000): Wait queue for user [
kraatzn01(a)bsclogon.buffalostate.edu] is empty.
> (Tue Jan 31 14:48:41 2017) [sssd[be[bsclogon.buffalostate.edu]]]
[krb5_auth_queue_done] (0x0040): krb5_auth_recv failed with: 22
> (Tue Jan 31 14:48:41 2017) [sssd[be[bsclogon.buffalostate.edu]]] [dp_req_done]
(0x0400): DP Request [PAM Authenticate #40]: Request handler finished [0]: Success
> (Tue Jan 31 14:48:41 2017) [sssd[be[bsclogon.buffalostate.edu]]] [_dp_req_recv]
(0x0400): DP Request [PAM Authenticate #40]: Receiving request data.
> (Tue Jan 31 14:48:41 2017) [sssd[be[bsclogon.buffalostate.edu]]]
[dp_req_destructor]
(0x0400): DP Request [PAM Authenticate #40]: Request removed.
> (Tue Jan 31 14:48:41 2017) [sssd[be[bsclogon.buffalostate.edu]]]
[dp_req_destructor]
(0x0400): Number of active DP request: 0
> (Tue Jan 31 14:48:41 2017) [sssd[be[bsclogon.buffalostate.edu]]]
[dp_method_enabled]
(0x0400): Target selinux is not configured
> (Tue Jan 31 14:48:41 2017) [sssd[be[bsclogon.buffalostate.edu]]] [dp_pam_reply]
(0x1000): DP Request [PAM Authenticate #40]: Sending result
[
4][bsclogon.buffalostate.edu]
> (Tue Jan 31 14:48:41 2017) [sssd[be[bsclogon.buffalostate.edu]]] [sbus_dispatch]
(0x4000): dbus conn: 0x7fb6b0b9f500
> (Tue Jan 31 14:48:41 2017) [sssd[be[bsclogon.buffalostate.edu]]] [sbus_dispatch]
(0x4000): Dispatching.
>
> [/quote]
> _______________________________________________
> sssd-users mailing list --
sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
sssd-users-leave(a)lists.fedorahosted.org
Ok. I tried a few things. I tried setting the attribute on the person to
username(a)buffalostate.edu and username(a)bsclogon.buffalostate.edu
I tried setting as you said, ldap_user_principle = nosuchattribute and ldap_user_principle
= sAMAccountName
I am still seeing the same issue.
Feb 1 11:34:39 bscacad3 sshd[19259]: Failed password for kraatzn01 from 136.183.201.231
port 64915 ssh2
Feb 1 11:34:41 bscacad3 sshd[19259]: Failed password for kraatzn01 from 136.183.201.231
port 64915 ssh2
Feb 1 11:34:42 bscacad3 sshd[19259]: error: Received disconnect from 136.183.201.231: 13:
Unable to authenticate [preauth]
Feb 1 11:34:50 bscacad3 sshd[19377]: Accepted password for andersnj01 from
136.183.201.231 port 64924 ssh2
I cleared the log, restarted sssd with debug=9 and captured a new log.
I want to attach it but It is 12k lines and I am using the web interface... is there a
better way? or is there sections I can show specifically for the two users (one that is
working one that isnt)? If you tell me how to sterilize it and which lines you need I can
cut and paste those as well.
BTW, after each change and test on the config files I did fire off a systemctl restart
sssd and restart sshd
Looking at ad currently:
userPrincipalName: kraatzn01(a)bsclogon.buffalostate.edu
userPrincipalName: andersnj01(a)bsclogon.buffalostate.edu