On 12 October 2017 at 08:35, Orion Poplawski <orion@nwra.com> wrote:
On 10/06/2017 08:29 PM, Lachlan Musicman wrote:
> You should check your sssd_domain logs (sssd_ad.nwra.com.log) for a time when
> someone is being denied - search for hbac_eval_user_element and check the
> number it returns versus the number of AD groups that user belongs to.

I've increased the logging to show this message now.  We'll see if it happens
again.

> If the problem is that sssd isn't getting the right number of groups, then
> updating to sssd version 1.15.3 will work.
>
> I don't know if or where that's packaged for ubuntu, sorry.
>
> I know it can be hard to reproduce, but if you can reproduce it, on the client do:
>
> - run the date command
> - run the login unsuccessfully (if it is indeed hbac for login)
> - run the date command.
>
> Then check the IPA logs for entries between the dates.

Just to be clear, what IPA logs do you mean?  I'm assuming you're talking
about on the server?  Or just the normal sssd logs on the client?


Yes, the logs on the server, not the client. Set the debug to 7, and then look in the log file titled (in Centos) sssd_unix.domain.org.log

Cheers
L.



------
"The antidote to apocalypticism is apocalyptic civics. Apocalyptic civics is the insistence that we cannot ignore the truth, nor should we panic about it. It is a shared consciousness that our institutions have failed and our ecosystem is collapsing, yet we are still here — and we are creative agents who can shape our destinies. Apocalyptic civics is the conviction that the only way out is through, and the only way through is together. "

Greg Bloom @greggish https://twitter.com/greggish/status/873177525903609857