On Tue, Feb 13, 2024 at 4:08 PM Eric Doutreleau < edoutreleau@genoscope.cns.fr> wrote:

Hi

I m using sssd-2.9.1 on Rocky linux 9 and i have stange behaviour with group enumeration.

Sorry I can't help with your issue immediately, but as a side note: 'enumeration' feature is poorly tested and considered as a misfeature for large domains in general.

Take a note, that starting sssd-2.10 feature is deprecated for ip_provider = ipa, ad: https://github.com/SSSD/sssd/commit/9240bca7dcc28371ae5dce31c01e85d28409cd04

And will not be supported (for those providers) in Fedora 40+ and in CentOS Stream / RHEL 10+

I stop sssd , remove the cache , and start sssd

when i run getent group i only get the local group.

i have put the sss_nss to debug level 9

and i got on the sssd_nss log file the follwing output

(2024-02-13 15:30:40): [nss] [sysdb_enumgrent_filter_with_views] (0x0040): [CID#10] sysdb_enumgrent failed. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:

• (2024-02-13 15:30:40): [nss] [cache_req_send] (0x0400): [CID#7] CR

#65: REQ_TRACE: New request [CID #7] 'Group by ID'

• (2024-02-13 15:30:40): [nss] [cache_req_select_domains] (0x0400):

[CID#7] CR #65: Performing a multi-domain search

• (2024-02-13 15:30:40): [nss] [cache_req_search_domains] (0x0400):

[CID#7] CR #65: Search will check the cache and check the data provider

• (2024-02-13 15:30:40): [nss] [cache_req_validate_domain_type]

(0x2000): [CID#7] Request type POSIX-only for domain ibfj-evry.fr type POSIX is valid

• (2024-02-13 15:30:40): [nss] [cache_req_set_domain] (0x0400):

[CID#7] CR #65: Using domain [ibfj-evry.fr]

• (2024-02-13 15:30:40): [nss] [cache_req_search_send] (0x0400):

[CID#7] CR #65: Looking up GID:533@ibfj-evry.fr

• (2024-02-13 15:30:40): [nss] [cache_req_search_ncache] (0x0400):

[CID#7] CR #65: Checking negative cache for [GID:533@ibfj-evry.fr]

• (2024-02-13 15:30:40): [nss] [sss_ncache_check_str] (0x2000):

[CID#7] Checking negative cache for [NCE/GID/ibfj-evry.fr/533]

• (2024-02-13 15:30:40): [nss] [sss_ncache_check_str] (0x2000):

[CID#7] Checking negative cache for [NCE/GID/533]

• (2024-02-13 15:30:40): [nss] [cache_req_search_ncache] (0x0400):

[CID#7] CR #65: [GID:533@ibfj-evry.fr] is not present in negative cache

• (2024-02-13 15:30:40): [nss] [cache_req_search_cache] (0x0400):

[CID#7] CR #65: Looking up [GID:533@ibfj-evry.fr] in cache

[....... line remove]]

• (2024-02-13 15:30:40): [nss] [cache_req_search_dp] (0x0400):

[CID#10] CR #78: Looking up [Groups enumeration] in data provider

• (2024-02-13 15:30:40): [nss] [sss_dp_get_account_send] (0x0400):

[CID#10] Creating request for [ibfj-evry.fr][0x2][BE_REQ_GROUP][*:-]

• (2024-02-13 15:30:40): [nss] [sbus_dispatch] (0x4000): Dispatching.
• (2024-02-13 15:30:40): [nss] [sss_domain_get_state] (0x1000):

[CID#10] Domain ibfj-evry.fr is Active

• (2024-02-13 15:30:40): [nss] [cache_req_search_cache] (0x0400):

[CID#10] CR #78: Looking up [Groups enumeration] in cache

• (2024-02-13 15:30:40): [nss] [sysdb_enumgrent_filter] (0x1000):

[CID#10] Searching timestamp cache with [(objectCategory=group)]

• (2024-02-13 15:30:40): [nss] [sysdb_cache_search_groups] (0x2000):

[CID#10] Search groups with filter: (&(objectCategory=group)(objectCategory=group))

• (2024-02-13 15:30:40): [nss] [sysdb_enumgrent_filter_with_views]

(0x0040): [CID#10] sysdb_enumgrent failed. ********************** BACKTRACE DUMP ENDS HERE

---

(2024-02-13 15:30:40): [nss] [cache_req_search_cache] (0x0020): [CID#10] CR #78: Unable to lookup [Groups enumeration] in cache [5]: Input/output error

i have look at the cache with ldbtool

i can read it

export LDB_URL=/var/lib/sss/db/cache_ibfj-evry.fr.ldb

give me the content of the cache without problem.

Here is the content of my sssd.conf file

nss] filter_groups = root,wheel debug_level = 3 filter_users = root,nrpe reconnection_retries = 9

[pam] offline_credentials_expiration = 0 debug_level = 3 reconnection_retries = 3

[domain/ibfj-evry.fr] ldap_user_name = sAMAccountName krb5_canonicalize = false ldap_user_home_directory = unixHomeDirectory cache_credentials = true ldap_group_object_class = group ldap_account_expire_policy = ad chpass_provider = ad entry_cache_timeout = 7200 id_provider = ad auth_provider = ad ldap_id_mapping = false ldap_referrals = false ldap_search_base = dc=ibfj-evry,dc=fr debug_level = 3 dyndns_update = False krb5_realm = IBFJ-EVRY.FR enumerate = true ldap_user_principal = userPrincipalName ldap_group_search_base = dc=ibfj-evry,dc=fr ldap_sasl_mech = GSSAPI ldap_user_search_base = dc=ibfj-evry,dc=fr

[sssd] debug_level = 3 reconnection_retries = 3 sbus_timeout = 30 domains = ibfj-evry.fr services = nss, pam config_file_version = 2

I don't know where to search now

-- _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue