On 12 October 2017 at 08:44, Lachlan Musicman <datakid(a)gmail.com> wrote:
On 12 October 2017 at 08:35, Orion Poplawski <orion(a)nwra.com>
wrote:
> On 10/06/2017 08:29 PM, Lachlan Musicman wrote:
> > You should check your sssd_domain logs (sssd_ad.nwra.com.log) for a
> time when
> > someone is being denied - search for hbac_eval_user_element and check
> the
> > number it returns versus the number of AD groups that user belongs to.
>
> I've increased the logging to show this message now. We'll see if it
> happens
> again.
>
> > If the problem is that sssd isn't getting the right number of groups,
> then
> > updating to sssd version 1.15.3 will work.
> >
> > I don't know if or where that's packaged for ubuntu, sorry.
> >
> > I know it can be hard to reproduce, but if you can reproduce it, on the
> client do:
> >
> > - run the date command
> > - run the login unsuccessfully (if it is indeed hbac for login)
> > - run the date command.
> >
> > Then check the IPA logs for entries between the dates.
>
> Just to be clear, what IPA logs do you mean? I'm assuming you're talking
> about on the server? Or just the normal sssd logs on the client?
>
Be mindful though - Jacob is an sssd/ipa developer. I am someone that had a
problem and Jacob's (and Sumit's and LS and...) advice got us home. Try his
solution first.
L.
------
"The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics
is the insistence that we cannot ignore the truth, nor should we panic
about it. It is a shared consciousness that our institutions have failed
and our ecosystem is collapsing, yet we are still here — and we are
creative agents who can shape our destinies. Apocalyptic civics is the
conviction that the only way out is through, and the only way through is
together. "
*Greg Bloom* @greggish
https://twitter.com/greggish/status/873177525903609857