[SSSD] ldap_result found nothing!

Patrik Martinsson Patrik.Martinsson at smhi.se
Thu Jul 29 11:17:37 UTC 2010


Hello everybody,

I've just started configuring sssd on rhel 6 beta 2 against our Windows 
AD Domain.
It looks like sssd is able to connect through ldap with password, but i 
cant seem to get
any results from the ldap_search, and was hoping for any kind if 
pointers/advises.

Here's how my sssd.conf looks,

--------------
[domain/FOO]
description = LDAP domain with AD server
enumerate = false
min_id = 1000
id_provider = ldap
auth_provider = ldap
ldap_uri = ldaps://foo.bar:636
ldap_schema = rfc2307bis
ldap_default_bind_dn = cn=xx,ou=People,dc=xx,dc=xx,dc=xx
ldap_default_authtok_type = password
ldap_default_authtok = xx
ldap_search_base = DC=xx,DC=xx,DC=xx
ldap_user_search_scope = sub
ldap_user_search_base = ou=People,dc=xx,dc=xx,dc=xx
ldap_group_search_base = ou=Groups,dc=xx,dc=xx,dc=xx
ldap_user_object_class = person
ldap_user_name = cn
ldap_user_uid_number = msSFU30UidNumber
ldap_user_gid_number = msSFU30GidNumber
ldap_user_home_directory = msSFU30HomeDirectory
ldap_user_shell = msSFU30LoginShell
ldap_user_principal = userPrincipalName
ldap_group_object_class = group
ldap_group_name = posixGroup
ldap_group_gid_number = msSFU30GidNumber
ldap_force_upper_case_realm = True
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer
ldap_tls_cacertdir = /etc/openldap/cacerts
--------------

Here's the output from sssd -d10 (the vital part, i think anyways)

(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_uri_callback] (6): 
Constructed uri 'ldaps://foo.bar:636'
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_rootdse_send] (9): 
Getting rootdse
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (6): 
calling ldap_search_ext with [(objectclass=*)][].
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [*]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [altServer]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [namingContexts]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [supportedControl]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [supportedExtension]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [supportedFeatures]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [supportedLDAPVersion]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [supportedSASLMechanisms]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] 
[sdap_ldap_connect_callback_add] (9): New LDAP connection to 
[ldaps://foo.bar:636] with fd [19].
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (8): 
ldap_search_ext called, msgid = 1
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: sh[0x1a91b30], connected[1], ops[0x1b8c840], ldap[0x1a91d90]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_parse_entry] (9): 
OriginalDN: []. <<<= ####### SHOULD THIS BE EMPTY? ########
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: sh[0x1a91b30], connected[1], ops[0x1b8c840], ldap[0x1a91d90]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_done] (6): 
Search result: Success(0), (null)
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_rootdse_done] (9): 
Got rootdse
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [simple_bind_send] (4): 
Executing simple bind as: cn=xx,ou=People,dc=xx,dc=xx,dc=xx
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [simple_bind_send] (8): ldap 
simple bind sent, msgid = 2
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: sh[0x1a91b30], connected[1], ops[0x1b6a7b0], ldap[0x1a91d90]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: ldap_result found nothing!
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: sh[0x1a91b30], connected[1], ops[0x1b6a7b0], ldap[0x1a91d90]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [simple_bind_done] (5): 
Server returned no controls.
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [simple_bind_done] (3): Bind 
result: Success(0), (null)
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [fo_set_port_status] (4): 
Marking port 636 of server 'foo.bar' as 'working'
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [set_server_common_status] 
(4): Marking server 'foo.bar' as 'working'
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (6): 
calling ldap_search_ext with 
[(&(cn=xx)(objectclass=person))][ou=People,dc=ad,dc=smhi,dc=se].
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [objectClass]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [cn]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [userPassword]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [msSFU30UidNumber]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [msSFU30GidNumber]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [gecos]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [msSFU30HomeDirectory]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [msSFU30LoginShell]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [userPrincipalName]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [cn]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [memberOf]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [nsUniqueId]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [modifyTimestamp]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [shadowLastChange]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [shadowMin]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [shadowMax]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [shadowWarning]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [shadowInactive]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [shadowExpire]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [shadowFlag]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [krbLastPwdChange]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [krbPasswordExpiration]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (7): 
Requesting attrs: [pwdAttribute]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_send] (8): 
ldap_search_ext called, msgid = 3
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: sh[0x1a91b30], connected[1], ops[0x1b69c30], ldap[0x1a91d90]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: ldap_result found nothing!
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: sh[0x1a91b30], connected[1], ops[0x1b69c30], ldap[0x1a91d90]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_parse_entry] (9): 
OriginalDN: [CN=a001584,OU=People,DC=ad,DC=smhi,DC=se].
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: sh[0x1a91b30], connected[1], ops[0x1b69c30], ldap[0x1a91d90]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_generic_done] (6): 
Search result: Success(0), (null)
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_users_process] (6): 
Search for users, returned 1 results.
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: sh[0x1a91b30], connected[1], ops[(nil)], ldap[0x1a91d90]
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_process_result] (8): 
Trace: ldap_result found nothing!
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [ldb] (9): start ldb 
transaction (nesting: 0)
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_save_user_send] (9): 
Save user
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_save_user_send] (1): no 
uid provided for [xx] in domain [FOO].
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_save_users_process] 
(2): Failed to store user 0. Ignoring.
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [ldb] (9): commit ldb 
transaction (nesting: 0)
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [sdap_get_users_done] (9): 
Saving 1 Users - Done
(Thu Jul 29 13:05:48 2010) [sssd[be[FOO]]] [acctinfo_callback] (4): 
Request processed. Returned 0,0,Success

Here's how a working ldapsearch looks like,
ldapsearch -x -L -Hldaps://foo.bar/ -D 
'cn=xxbind,ou=People,dc=xx,dc=xx,dc=xx' -w xxbindpwd -b 
'dc=xx,dc=xx,dc=xx' '(&(cn=xx)(objectclass=person))' cn uid
This returns, as expected cn/uid for the requested user.

As i said, any tips is appreciated.
I'm not an expert in ldap nor AD, so please go easy on me.

/Patrik Martinsson, Sweden.






More information about the sssd-devel mailing list