On Mon, Apr 07, 2014 at 11:08:00AM +0200, Angel Bosch wrote:
hi!
I'm having problems with enumerate = true
If i query single user with id <user> or getent passwd <user> i get a
succesful response. but I can't get a full list with
getent group
or
getent passwd
I get this in log:
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client
version [1].
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version
[1].
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [nss_cmd_setgrent_send] (0x0100): Received setgrent
request
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [nss_cmd_getgrent] (0x0100): Requesting info for
all groups
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [nss_cmd_getgrent] (0x0100): Requesting info for
all groups
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [nss_cmd_endgrent] (0x0100): Terminating request
info for all groups
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [client_recv] (0x0200): Client disconnected!
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client
version [1].
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version
[1].
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [nss_cmd_setpwent_send] (0x0100): Received setpwent
request
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [nss_cmd_getpwent] (0x0100): Requesting info for
all accounts
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [nss_cmd_getpwent] (0x0100): Requesting info for
all accounts
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [nss_cmd_endpwent] (0x0100): Terminating request
info for all accounts
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [client_recv] (0x0200): Client disconnected!
this is my conf:
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains =
XXX.net
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
debug_level = 5
[pam]
reconnection_retries = 3
[
domain/XXX.net]
enumerate = true
cache_credentials = true
debug_level = 5
min_id = 500
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_schema = rfc2307bis
ldap_uri =
ldap://XXX.XXX.net
ldap_search_base = dc=example,dc=global
ldap_tls_reqcert = demand
# ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
ldap_tls_cacertdir = /etc/ssl/certs
some more info:
# sssd --version
1.9.2
# lsb_release -a
LSB Version: :base-4.0-ia32:base-4.0-noarch:core-4.0-ia32:core-4.0-noarch
Distributor ID: CentOS
Description: CentOS release 6.5 (Final)
Release: 6.5
Codename: Final
anyone facing same problem?
Can you see the enumeration task in the sssd domain log? It should run
after startup (with some delay in order not to interfere with system
startup) and download all users and groups.
I'd start the investigation there, the config file looks OK.
btw in general I don't recommend enumeration if your directory is very
large (thousands or tens of thousands of entries), the sssd might be
trashing the disk saving so many entries.