Jakub Hrozek wrote:
On Sun, Mar 15, 2015 at 08:53:40PM +0100, Michael Ströder wrote:
> Jakub Hrozek wrote:
>> I re-read the logs again and you're right we don't seem to error out on
>> on anything else than GSSAPI (which is what I thought previously).
>> Nonetheless, it would be great to see the domain logs.
>
> Which log level is that?
I would like to hit this line:
923
924 DEBUG(SSSDBG_CONF_SETTINGS, "Executing sasl bind mech: %s, user:
%s\n",
925 sasl_mech, sasl_user);
Ok, here it comes. Solely test stuff => no confidential data in there.
Subject DN of client cert is:
cn=ae-client1.example.org,ou=ito,o=stroeder.com,l=karlsruhe,st=ba-wue,c=de
LDAP DN of sssd client is:
host=ae-client1.example.org,cn=example-srvgrp-1,cn=example,ou=ae-dir
You can see in the log excerpt below how OpenLDAP's slapd maps it (see lines
with "BIND authcid" and "BIND dn=").
BTW: I consider it to be a bug that sssd tries to read the rootDSE before binding.
In the sssd domain log you can find:
(Mon Mar 16 10:24:26 2015) [sssd[be[AE-DIR]]] [sasl_bind_send] (0x0100):
Executing sasl bind mech: EXTERNAL, user: (null)
Find sssd.conf, client cert and /var/log/sssd/ in the attached tar.xz.
Ciao, Michael.
---------------------------- slapd's log -------------------------------
5506a14d conn=1000 fd=13 ACCEPT from IP=172.16.15.137:51064 (IP=0.0.0.0:2342)
5506a14d conn=1000 op=0 EXT oid=1.3.6.1.4.1.1466.20037
5506a14d conn=1000 op=0 STARTTLS
5506a14d conn=1000 op=0 RESULT oid= err=0 text=
5506a14d conn=1000 fd=13 TLS established tls_ssf=256 ssf=256
5506a14d conn=1000 op=1 SRCH base="" scope=0 deref=0
filter="(objectClass=*)"
5506a14d conn=1000 op=1 SRCH attr=* altServer namingContexts supportedControl
supportedExtension supportedFeatures supportedLDAPVersion
supportedSASLMechanisms domainControllerFunctionality defaultNamingContext
lastUSN highestCommittedUSN
5506a14d conn=1000 op=1 SEARCH RESULT tag=101 err=8 nentries=0 text=strong(er)
authentication required
5506a14d conn=1000 op=2 BIND dn="" method=163
5506a14d <= mdb_equality_candidates: (aeStatus) not indexed
5506a14d conn=1000 op=2 BIND
authcid="cn=ae-client1.example.org,ou=ito,o=stroeder.com,l=karlsruhe,st=ba-wue,c=de"
authzid="cn=ae-client1.example.org,ou=ito,o=stroeder.com,l=karlsruhe,st=ba-wue,c=de"
5506a14d conn=1000 op=2 BIND
dn="host=ae-client1.example.org,cn=example-srvgrp-1,cn=example,ou=ae-dir"
mech=EXTERNAL sasl_ssf=0 ssf=256
5506a14d conn=1000 op=2 RESULT tag=97 err=0 text=
5506a14d conn=1000 op=3 SRCH base="" scope=0 deref=0
filter="(objectClass=*)"
5506a14d conn=1000 op=3 SRCH attr=* altServer namingContexts supportedControl
supportedExtension supportedFeatures supportedLDAPVersion
supportedSASLMechanisms domainControllerFunctionality defaultNamingContext
lastUSN highestCommittedUSN
5506a14d conn=1000 op=3 ENTRY dn=""
5506a14d conn=1000 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text=
5506a14d conn=1000 op=4 SRCH base="ou=ae-dir" scope=2 deref=0
filter="(&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))"
5506a14d conn=1000 op=4 SRCH attr=objectClass uid userPassword uidNumber
gidNumber gecos homeDirectory loginShell krbPrincipalName cn memberOf
modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax
shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange
krbPasswordExpiration pwdAttribute authorizedService accountExpires
userAccountControl nsAccountLock host loginDisabled loginExpirationTime
loginAllowedTimeMap sshPublicKey
5506a14d conn=1000 op=5 SRCH base="ou=ae-dir" scope=2 deref=0
filter="(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=ae-client1)(sudoHost=ae-client1.example.com)(sudoHost=172.16.15.137)(sudoHost=172.16.15.0/24)(sudoHost=fe80::20c:29ff:fe02:711c)(sudoHost=fe80::/64)(?sudoHost=+*)(|(?sudoHost=*\5C*)(?sudoHost=*?*)(?sudoHost=*\2A*)(?sudoHost=*[*]*))))"
5506a14d conn=1000 op=5 SRCH attr=objectClass cn sudoCommand sudoHost sudoUser
sudoOption sudoRunAs sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
sudoOrder modifyTimestamp