[SSSD] Problems configuring sssd for ssl/ldaps no tls

sssd help sssdhelp at gmail.com
Thu Feb 10 19:39:48 UTC 2011


Stephen, I installed the packages you sent me. Here is the new log output:

(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [simple_bind_send] (4):
Executing simple bind as: uid=testuser,ou=people,dc=mydomain,dc=com
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [simple_bind_send] (8): ldap
simple bind sent, msgid = 2
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [sdap_process_result] (8):
Trace: sh[0x8f6900], connected[1], ops[0xe3b510], ldap[0xc3b000]
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [sdap_process_result] (4):
ldap_result gave -1, something bad happened!
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [sdap_process_result] (4):
ldap_result failed: [(null)]
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [sdap_handle_release] (8):
Trace: sh[0x8f6900], connected[1], ops[0xe3b510], ldap[0xc3b000],
destructor_lock[0], release_memory[0]
(Thu Feb 10 14:26:30 2011) [sssd[be[default]]] [remove_connection_callback]
(9): Successfully removed connection callback.

To get authentication to work with sssd I found that i have to edit
sssd.conf in a couple of places. One, change the ldap_uri to
ldap.mydomain.com and Two, change ldap_tls_reqcert to "never". When
ldap_tls_reqcert is set to default (hard/demand) authentication fails. I
decided to tail access logs on our ldap server to look at the difference in
a request from my test machine that works (over 389/ldap) and one that fails
(over 686/ldaps)

Failed request:

[10/Feb/2011:14:23:05 -0500] conn=581553 op=9 msgId=11 - SRCH
base="ou=people,dc=mydomain,dc=com" scope=2
filter="(&(uid=testuser)(objectClass=posixAccount))" attrs="objectClass uid
userPassword uidNumber gidNumber gecos homeDirectory loginShell
krbprincipalname cn modifyTimestamp shadowLastChange shadowMin shadowMax
shadowWarning shadowInactive shadowExpire shadowFlag krblastpwdchange
krbpasswordexpiration pwdAttribute"
[10/Feb/2011:14:23:05 -0500] conn=581553 op=9 msgId=11 - RESULT err=0
tag=101 nentries=1 etime=0


Successful request:

[10/Feb/2011:14:33:43 -0500] conn=581558 op=27 msgId=29 - SRCH
base="ou=people,dc=mydomain,dc=com" scope=2
filter="(&(uid=testuser)(objectClass=posixAccount))" attrs="objectClass uid
userPassword uidNumber gidNumber gecos homeDirectory loginShell
krbprincipalname cn modifyTimestamp shadowLastChange shadowMin shadowMax
shadowWarning shadowInactive shadowExpire shadowFlag krblastpwdchange
krbpasswordexpiration pwdAttribute"
[10/Feb/2011:14:33:43 -0500] conn=581558 op=27 msgId=29 - RESULT err=0
tag=101 nentries=1 etime=0

The requests seem to yeild the same results so im confused as to why one is
failing and the other is not.

I should note that in the ssl cert directory i am using the same cert that
we use on all of the other systems in our environment (mostly RHEL5.3) and i
have run cacertdir_rehash on the directory as it says in the sssd-ldap(5)
man page.

Any suggestions? Thank you for your help so far.



On Thu, Feb 10, 2011 at 1:59 PM, Stephen Gallagher <sgallagh at redhat.com>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 02/10/2011 01:53 PM, sssd help wrote:
> > Thank you for the reply Stephen. I will begin work on the build you
> > provided.
> >
> > To answer your question about TLS vs SSL, we cant use TLS in our
> > environment because of a number of tools we use that need to
> > authenticate to ldap and do not support TLS. So for the time being LDAPS
> > is the only way to go for us.
> >
> > I also didnt realize that we were using a slightly outdated version of
> > sssd. Ill do some upgrade testing as well and let you know.
> >
> > Thanks again!
>
> There should be no upgrade issues from 1.2.1-28 to 1.2.1-28.4. There are
> just a few bugfixes.
>
> I based the scratch-build I sent you on 1.2.1-28.4 (with the extra
> logging patch included)
>
> - --
> Stephen Gallagher
> RHCE 804006346421761
>
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1UNZQACgkQeiVVYja6o6OFhwCgpMCAwD5LlY2gA0Aesn+mhc/M
> UL4An2CNSB/XbtuoEAcSkFI69eNJULzm
> =XaBq
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110210/0c29ff58/attachment.html>


More information about the sssd-devel mailing list