On Sat, Apr 23, 2016 at 01:48:54PM +0200, Rolla Matthieu wrote:
Hello Sumit,
Please find attach the trace as requested.
I use debian 8 with sernet SAMBA 4 , backend bind_DLZ. POSIX attributs are
active and working.
Regarding SSSD:
It's running on the last Centos 7. here are the packages :
[root@gtwdcsmb ~]# rpm -qa | grep -E "sssd|realm"
sssd-client-1.13.0-40.el7_2.2.x86_64
sssd-common-pac-1.13.0-40.el7_2.2.x86_64
sssd-krb5-1.13.0-40.el7_2.2.x86_64
sssd-debuginfo-1.13.0-40.el7_2.2.x86_64
python-sssdconfig-1.13.0-40.el7_2.2.noarch
sssd-krb5-common-1.13.0-40.el7_2.2.x86_64
sssd-ipa-1.13.0-40.el7_2.2.x86_64
sssd-ldap-1.13.0-40.el7_2.2.x86_64
sssd-proxy-1.13.0-40.el7_2.2.x86_64
realmd-0.16.1-5.el7.x86_64
sssd-common-1.13.0-40.el7_2.2.x86_64
sssd-ad-1.13.0-40.el7_2.2.x86_64
sssd-1.13.0-40.el7_2.2.x86_64
Also, regarding sssd, DNS registration ( forward and reverse ) and the
registration of the computer in a specific OU with realm are working when
sssd is starting. Or when a Machine is joining the Domain.
SSSD tries to run a dynamic DNS update whenever it goes online, i.e. at
startup and at runtime when the configured servers show up in the
network again.
Currently, Authenfication is working but the GPO are not applicated /
called. Same as prviously, things gpo_child.log is not growing and the GPO
does not seems to be called...
I hope the trace will help you to identify the source of the problem.
As I mention earlier, as a test, I also setup a POC with windows 2012 as
DC. SSSD is working without problem, GPO too.
If you need anything else please let me know and thank for your help.
...
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]]
[ad_gpo_filter_gpos_by_dacl] (0x4000): examining dacl
candidate_gpo_guid:{31B2F340-016D-11D2-945F-00C04FB984F9}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000):
GPO not applicable to target per security filtering
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000):
examining dacl candidate_gpo_guid:{5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000):
GPO applicable to target per security filtering
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_process_gpo_done] (0x0400):
dacl_filtered_gpos[0]->gpo_guid is {5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_cse_guid]
(0x4000): examining cse candidate_gpo_guid: {5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_cse_guid]
(0x4000): GPO applicable to target per cse_guid filtering
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_process_gpo_done] (0x0400):
cse_filtered_gpos[0]->gpo_guid is {5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_process_gpo_done] (0x0400):
num_cse_filtered_gpos: 1
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): start ldb transaction
(nesting: 0)
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_result_object]
(0x4000): cn=gpos,cn=ad,cn=custom,cn=mydc.com,cn=sysdb
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0x7f2f84015c90
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
"ltdb_timeout": 0x7f2f84009f00
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Running timer event
0x7f2f84015c90 "ltdb_callback"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Destroying timer event
0x7f2f84009f00 "ltdb_timeout"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Ending timer event
0x7f2f84015c90 "ltdb_callback"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_result_object]
(0x4000): No GPO Result object.
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): commit ldb transaction
(nesting: 0)
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): cse
filtered_gpos[0]->gpo_guid is {5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x4000):
cse_filtered_gpos[0]->gpo_cse_guids[0]->gpo_guid is
{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): smb_server:
smb://DC02.mydc.com
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): smb_share:
/SysVol
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): smb_path:
/mydc.com/Policies/{5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): gpo_guid:
{5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): retrieving
GPO from cache [{5C320202-3B01-4865-B495-395BD580B315}]
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_by_guid] (0x4000):
cn=gpos,cn=ad,cn=custom,cn=mydc.com,cn=sysdb
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0x7f2f84009f80
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
"ltdb_timeout": 0x7f2f8400b290
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Running timer event
0x7f2f84009f80 "ltdb_callback"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Destroying timer event
0x7f2f8400b290 "ltdb_timeout"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Ending timer event
0x7f2f84009f80 "ltdb_callback"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_by_guid] (0x4000): No
such entry.
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): ENOENT
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400):
send_to_child: 1
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400):
cached_gpt_version: -1
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [create_cse_send_buffer] (0x4000): buffer
size: 158
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_handler_setup] (0x2000): Setting
up signal handler up for pid [4243]
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_handler_setup] (0x2000): Signal
handler set up for pid [4243]
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sdap_process_result] (0x2000): Trace:
sh[0x7f2f83fcae70], connected[1], ops[(nil)], ldap[0x7f2f83f91be0]
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sdap_process_result] (0x2000): Trace:
ldap_result found nothing!
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [write_pipe_handler] (0x0400): All data
has been sent!
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0400): gpo_child started.
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0400): context
initialized
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x0400):
cached_gpt_version: -1
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_server
length: 22
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000):
smb_server:
smb://DC02.mydc.com
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_share
length: 7
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_share:
/SysVol
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_path
length: 60
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_path:
/mydc.com/Policies/{5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000):
smb_cse_suffix length: 49
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000):
smb_cse_suffix: /Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0400): performing smb
operations
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [copy_smb_file_to_gpo_cache]
(0x0400): smb_uri:
smb://DC02.mydc.com/SysVol/mydc.com/Policies/{5C320202-3B01-4865-B495-395...
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [copy_smb_file_to_gpo_cache]
(0x0020): smbc_getFunctionOpen failed [2][No such file or directory]
If I understood it correctly
DC02.mydc.com is a Samba4 DC. Does it
provide a SysVol share which contains the gpo file
/mydc.com/Policies/{5C320202-3B01-4865-B495-395BD580B315}/GPT.INI ?
bye,
Sumit
> (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [perform_smb_operations]
(0x0020): copy_smb_file_to_gpo_cache failed [2][No such file or directory]
> (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0020):
perform_smb_operations failed.[2][No such file or directory].
> (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0020): gpo_child
failed!
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [read_pipe_handler] (0x0400): EOF
received, client finished
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [gpo_cse_done] (0x0020):
ad_gpo_parse_gpo_child_response failed: [22][Invalid argument]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_done] (0x0400): gpo_guid:
{5C320202-3B01-4865-B495-395BD580B315}
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_done] (0x0040): Unable to
retrieve policy data: [22](Invalid argument}
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_access_done] (0x0040):
GPO-based access control failed.
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_access_done] (0x0040):
Ignoring error: [22](Invalid argument); GPO-based access control failed, but GPO is not in
enforcing mode.
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0100):
Backend returned: (0, 0, <NULL>) [Success (Success)]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0400):
SELinux provider doesn't exist, not sending the request to it.
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0100):
Sending result [
0][mydc.COM]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0100):
Sent result [
0][mydc.COM]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_sig_handler] (0x1000): Waiting
for child [4243].
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_sig_handler] (0x0020): child
[4243] failed with status [1].
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [sbus_remove_timeout] (0x2000):
0x7ffaccc16a20
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn:
0x7ffaccc0f810
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching.
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [pam_dp_process_reply] (0x0200): received: [0
(
Success)][mydc.COM]
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with
result [0]: Success.
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 28