On 12 October 2017 at 08:35, Orion Poplawski <orion(a)nwra.com> wrote:
On 10/06/2017 08:29 PM, Lachlan Musicman wrote:
> You should check your sssd_domain logs (sssd_ad.nwra.com.log) for a time
when
> someone is being denied - search for hbac_eval_user_element and check the
> number it returns versus the number of AD groups that user belongs to.
I've increased the logging to show this message now. We'll see if it
happens
again.
> If the problem is that sssd isn't getting the right number of groups,
then
> updating to sssd version 1.15.3 will work.
>
> I don't know if or where that's packaged for ubuntu, sorry.
>
> I know it can be hard to reproduce, but if you can reproduce it, on the
client do:
>
> - run the date command
> - run the login unsuccessfully (if it is indeed hbac for login)
> - run the date command.
>
> Then check the IPA logs for entries between the dates.
Just to be clear, what IPA logs do you mean? I'm assuming you're talking
about on the server? Or just the normal sssd logs on the client?
Yes, the logs on the server, not the client. Set the debug to 7, and then
look in the log file titled (in Centos) sssd_unix.domain.org.log
Cheers
L.
------
"The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics
is the insistence that we cannot ignore the truth, nor should we panic
about it. It is a shared consciousness that our institutions have failed
and our ecosystem is collapsing, yet we are still here — and we are
creative agents who can shape our destinies. Apocalyptic civics is the
conviction that the only way out is through, and the only way through is
together. "
*Greg Bloom* @greggish
https://twitter.com/greggish/status/873177525903609857