(Wed Aug 20 12:21:17 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5]
(Wed Aug 20 14:34:38 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5]
(Wed Aug 20 15:22:52 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5]
(Wed Aug 20 16:03:46 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5]
(Wed Aug 20 16:24:53 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5]
(Wed Aug 20 16:49:04 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5]
(Wed Aug 20 17:45:55 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5]
(Wed Aug 20 18:05:01 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5]
(Thu Aug 21 02:20:38 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 04:43:38 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 10:27:18 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 10:32:27 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 10:52:46 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 16:38:27 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 17:08:06 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 17:41:15 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements
For this i filed a bug:
https://fedorahosted.org/sssd/ticket/2418
Secondly when running without AD performance enhancements all logins fail when going through the users parent groups.
This error disables the AD login for my RHEL servers.
Here are the failure points in sssd log for 3 different users:
From my login attempt:
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name]
(0x0400): No such entry
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Group #34 [SKYPEDWETL4] is not cached, need to add a fake entry
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb transaction (nesting: 2)
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Mapping group [FTE_europe_2] objectSID to unix ID
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSID] attribute while id-mapping. [0][Success]
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 2)
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store] (0x0400): Could not add incomplete groups [2]: No such file or directory
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 1)
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups] (0x0080): Could not save groups [2]: No such file or directory
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done] (0x0080): Could not save groups memberships [2](Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0)
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Initgroups done
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Error in initgroups: [2][No such file or directory]
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000): releasing operation connection
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: sh[0x23dfc50], connected[1], ops[(nil)], ldap[0x23dead0]
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
My colleague login attempt:
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name] (0x0400): No such entry
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Group #32 [SKYPEDWETL4] is not cached, need to add a fake entry
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb transaction (nesting: 2)
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Mapping group [SKYPE_ES_BI_FTE] objectSID to unix ID
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSID] attribute while id-mapping. [0][Success]
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 2)
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store] (0x0400): Could not add incomplete groups [2]: No such file or directory
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 1)
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups] (0x0080): Could not save groups [2]: No such file or directory
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done] (0x0080): Could not save groups memberships [2](Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0)
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Initgroups done
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Error in initgroups: [2][No such file or directory]
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000): releasing operation connection
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: sh[0x23dff60], connected[1], ops[(nil)], ldap[0x23de070]
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
Another collegue:
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name]
(0x0400): No such entry
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Group #34 [SKYPEDW_FILESHARE_TEST_TPUM_RO] is not cached, need to add a fake entry
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb transaction (nesting: 2)
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Mapping group [SKYPE_ES_BI_FTE] objectSID to unix ID
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSID] attribute while id-mapping. [0][Success]
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 2)
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store] (0x0400): Could not add incomplete groups [2]: No such file or directory
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 1)
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups] (0x0080): Could not save groups [2]: No such file or directory
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done] (0x0080): Could not save groups memberships [2](Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0)
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Initgroups done
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Error in initgroups: [2][No such file or directory]
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000): releasing operation connection
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: sh[0x23dff60], connected[1], ops[(nil)], ldap[0x23de070]
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
My sssd.conf looks like this:
##########################################################
[sssd]
domains = MS_AD
services = nss,pam
config_file_version = 2
[nss]
filter_users = root,etl,gpadmin,nws
filter_groups = root,etl,gpadmin,nws
default_shell = /bin/bash
[pam]
reconnection_retries = 3
offline_credentials_expiration = 1
offline_failed_login_attempts = 1
[domain/MS_AD]
description = LDAP domain with MS AD server
debug_level = 9
# caching credentials
enumerate = false
cache_credentials = false
min_id = 1000
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_tls_reqcert = never
ldap_id_mapping = True
ldap_schema = ad
ldap_idmap_range_min = 10000
ldap_idmap_range_max = 2000100000
ldap_idmap_range_size = 20000000
ldap_uri = ldap://adserveraddress/
ldap_search_base = OU=UserAccounts,DC=something,DC=something,DC=something,DC=com
ldap_default_bind_dn = CN=Bind User Name,OU=UserAccounts,DC=something,DC=something,DC=something,DC=com
ldap_default_authtok_type = password
ldap_default_authtok = passwordgoeshere
ldap_user_object_class = user
ldap_group_object_class = group
ldap_user_name = sAMAccountName
ldap_user_objectsid = objectSid
ldap_group_objectsid = objectGUID
ldap_user_search_filter = memberOf=CN=SKYPEDWETL4,OU=UserAccounts,DC=something,DC=something,DC=something,DC=com
override_homedir = /home/%u
# performance
ldap_disable_referrals = true
##########################################################
Have any of you had experiences with errors like this?
Many thanks for your attention!
Thanks,
Kristjan Elias