On Mon, Sep 21, 2015 at 09:48:59PM +0200, Jakub Hrozek wrote:
On Mon, Sep 21, 2015 at 07:35:13PM +0100, John Beranek wrote:
> I don't understand quite why SSSD might be performing a reverse lookup
> on a selected DC's IP, and then using that in a Kerberos request, if
> that is in fact what it's doing.
btw this might not be sssd, but rather libkrb5 or cyrus-sasl. I haven't
seen the logs, but I wonder if rdns=False in krb5.conf would help here?
Hi John,
Thank you for the log files. I think Jakub is right the error occurs
during ldap_sasl_bind() and the logs show that your working and
non-working setup are using the server names to connect to.
In RHEL/CentOS 6 rdns is not set in krb5.conf and the default is 'true'
which means that a reverse DNS lookup might happen during the SASL bind
(SSSD does not do any reverse lookups on it's own). Since this only
covers the Kerberos part you should also set
SASL_NOCANON on
in /etc/openldap/ldap.conf.
In RHEL-7 and current Fedora versions we changed this and have the
setting above already in the default installation.
HTH
bye,
Sumit