On 10/06/2017 08:29 PM, Lachlan Musicman wrote:
> You should check your sssd_domain logs (sssd_ad.nwra.com.log) for a time when
> someone is being denied - search for hbac_eval_user_element and check the
> number it returns versus the number of AD groups that user belongs to.
I've increased the logging to show this message now. We'll see if it happens
again.
> If the problem is that sssd isn't getting the right number of groups, then
> updating to sssd version 1.15.3 will work.
>
> I don't know if or where that's packaged for ubuntu, sorry.
>
> I know it can be hard to reproduce, but if you can reproduce it, on the client do:
>
> - run the date command
> - run the login unsuccessfully (if it is indeed hbac for login)
> - run the date command.
>
> Then check the IPA logs for entries between the dates.
Just to be clear, what IPA logs do you mean? I'm assuming you're talking
about on the server? Or just the normal sssd logs on the client?