[SSSD] SIGSEGV in sssd_be using ldap_init_fd

Jan Zelený jzeleny at redhat.com
Fri Jul 29 11:20:11 UTC 2011


> On Fri, 29 Jul 2011, Jakub Hrozek wrote:
> > On 07/29/2011 12:44 PM, Jakub Hrozek wrote:
> >> On 07/29/2011 12:07 PM, John Hodrien wrote:
> >>> I've looked at this, but can't see the wood for the trees.
> >>> 
> >>> Starting from 1.59 I can't use GSSAPI or TLS with LDAP.  I've tried all
> >>> versions up to current git and I get the same basic result.
> >>> 
> >>> Undefining HAVE_LDAP_INIT_FD by editing the ldap.m4 to remove the test
> >>> returns it to life.  Equally, not using TLS or GSSAPI works.
> >>> 
> >>> This is pointed at an Active Directory domain, using a machine
> >>> credential for the authentication.
> >>> 
> >>> Here's a stack trace from sssd_be aginst the current git HEAD
> >> 
> >>> (d6354aa46716751a41ddab86bc64c1c7c218c5cc) when using GSSAPI:
> >> What distribution are you running? What openldap library versions?
> > 
> > Also can you attach your sanitized sssd.conf?
> 
> Thanks for the help with this.
> 
> CentOS 6.0, but with updated packages built from RHEL SRPMS
> (ding-libs/krb5) to support more recent sssd.  This likely to be a problem
> of my own making?
> 
> openldap-2.4.19-15.el6_0.2.x86_64 (original CentOS 6.0 package).

I suspect this to be the source of your problem. This is really archaic 
version of openldap when used with SSSD. There have been huge changes in 
libldap, more specifically it stopped using openssl as its backend and it is 
now utilizing Mozilla NSS instead. Also many other TLS-related fixes have been 
made in recent versions.

Please try to use newer libldap, I believe, most recent in RHEL is 2.4.23.

Just to be sure, you can run rpm -q --requires openldap and see if openssl is 
there somewhere (there should be none).

Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110729/f5445c47/attachment.sig>


More information about the sssd-devel mailing list