On Fri, Jan 19, 2024 at 12:39 PM Finn Fysj
<finnfysj133(a)gmail.com> wrote:
Well, to debug this one needs:
- stop sssd
- remove old sssd logs (/var/log/sssd/)
- set 'debug_level = 9' in [nss] and domain sections of sssd.conf
- start sssd
- date; id UID
- capture logs
Then `sssctl analyze --logdir . request list` - it will list 'id' -
it will list something like "... [uid 0] CID #1: id"
And `sssctl analyze --logdir . request show --merge 1` (where 1 is
from CID #1) will show all log messages related to this lookup.
Not an easy read, though...
Looking furher into sssd_default.log:
(2024-01-21 16:34:40): [be[default]] [sysdb_store_group] (0x0400): [RID#31] Group
"prod-users@default" has been stored
(2024-01-21 16:34:40): [be[default]] [sdap_save_groups] (0x4000): [RID#31] Group 0
processed!
(2024-01-21 16:34:40): [be[default]] [sdap_attrs_get_sid_str] (0x1000): [RID#31] No
[objectSID] attribute. [0][Success]
(2024-01-21 16:34:40): [be[default]] [sdap_save_grpmem] (0x0400): [RID#31] Failed to get
group sid
(2024-01-21 16:34:40): [be[default]] [sdap_get_primary_name] (0x0400): [RID#31] Processing
object prod-users
(2024-01-21 16:34:40): [be[default]] [sdap_save_grpmem] (0x0400): [RID#31] Processing
group prod-users@default
(2024-01-21 16:34:40): [be[default]] [sdap_save_grpmem] (0x0400): [RID#31] Adding member
users to group [prod-users@default]
(2024-01-21 16:34:40): [be[default]] [sdap_find_entry_by_origDN] (0x4000): [RID#31]
Searching cache for [uid=user1,cn=users,cn=accounts,dc=example,dc=com].
(2024-01-21 16:34:40): [be[default]] [sdap_fill_memberships] (0x1000): [RID#31] member
#0 (uid=user1,cn=users,cn=accounts,dc=example,dc=com):
[name=user1@default,cn=users,cn=default,cn=sysdb]
(2024-01-21 16:34:40): [be[default]] [sdap_find_entry_by_origDN] (0x4000): [RID#31]
Searching cache for [cn=prod-users,cn=groups,cn=accounts,dc=example,dc=com].
(2024-01-21 16:34:40): [be[default]] [sdap_fill_memberships] (0x0080): [RID#31] Member
[cn=devs,cn=groups,cn=accounts,dc=example,dc=com] was not found in cache. Is it out of
scope?
(2024-01-21 16:34:40): [be[default]] [sdap_find_entry_by_origDN] (0x4000): [RID#31]
Searching cache for [uid=user2,cn=users,cn=accounts,dc=example,dc=com].
(2024-01-22 16:34:40): [be[default]] [sdap_fill_memberships] (0x1000): [RID#31] member
#2 (uid=user2,cn=users,cn=accounts,dc=example,dc=com):
[name=user2@default,cn=users,cn=default,cn=sysdb]
It's important to note that the groups "devs" is a NON-Posix group in
FreeIPA. However, as preivously stated, this works with nss-pam-ldapd.