[SSSD] Problems configuring sssd for ssl/ldaps no tls

Stephen Gallagher sgallagh at redhat.com
Thu Feb 10 18:47:00 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/10/2011 12:40 PM, sssd help wrote:
> Hello. We are building a kickstart profile so that we can begin using
> RHEL 6 in our environment. However, we have run into a problem with sssd
> and ldaps. It seems that in RHEL 6 nss_ldap has been depreciated and
> replaced with sssd. I have been able to configure sssd for regular ldap
> without problem. When I attempt to enable ldaps by changing the ldap uri
> to ldaps:// authentication no longer functions. However, id and getent
> functionality remains. Debug level was changed to 10 and here is what I
> see in the logs for sssd.
> 
...
> Unfortunately, "Something bad happend!" isn't quite specific enough to
> track down the problem.
...
> Please let me know if there is other information that you need.
> 
> Thank you very much for any help you can provide. Ive been trying to
> track down this problem for three days.
> 


Could you explain why you're switching from TLS to LDAPS? In most cases,
I would think that TLS would be preferable.

I've been trying to reproduce this problem locally, but it's working
fine for me with sssd-1.2.1-28.el6_0.4.x86_64 (the latest available
errata for RHEL6).

The reason for the "Something bad happend!" error is because that's a
section of the code where the openldap client libraries (which we use to
perform our LDAP routines) has reported an error but not a reason for
the error. So unfortunately, I'm not sure we can get any better
information there. The manual page for this openldap function reads:
"ldap_result() returns -1 if something bad happens". There's no
indication of any way to get more information from the library about why
it failed.

There's a possibility that more information will be available from the
LDAP_DIAGNOSTIC_MESSAGE, though this isn't documented. I've created a
scratch build of SSSD for you to try. If extra information is available,
it should be printed with the included patch.

Please download and try out the RPMs from
http://koji.fedoraproject.org/koji/taskinfo?taskID=2830662 and then
please let me know if the added logging gives any clues.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1UMqQACgkQeiVVYja6o6PXdQCfdcwqHHiY3sUoQJYCivewr/fu
WdgAn2TvDXB2HmsCPVebfEJm5BdHoihN
=tRYb
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list