[SSSD] new ldap users inconsistently able to auth on existing servers

Johnny Tan jt at renttherunway.com
Fri Jun 17 21:46:25 UTC 2011


On Fri, Jun 17, 2011 at 5:37 PM, Jeff Schroeder
<jeffschroeder at computer.org> wrote:
> On Fri, Jun 17, 2011 at 2:12 PM, Johnny Tan <jt at renttherunway.com> wrote:
>> I recently setup sssd (sssd-1.2.1-39.el5) in our environment. We have
>> an LDAP server running openldap-servers-2.3.43-12.el5_5.2.x86_64.
>>
>> It seems that certain users can't authenticate to certain servers. All
>> servers have identical sssd.conf, nsswitch.conf, and system-auth-ac
>> files (pushed by puppet). I haven't yet found a pattern as to which
>> users and which servers, as it seems to be random.
> ... snip ...
>
>> My own hypothesis is that the successful auth is using cached
>> credentials (since jt has logged in previously), but the failed one is
>> from a user that has not successfully logged into the server. But if
>> I'm correct, what I don't get is why sssd cannot pull information from
>> the LDAP provider. It's online and serving out requests, and the
>> failed user on this machine has successfully logged in for the first
>> time on a couple other servers in the same timeframe.
>>
>> Thoughts?
>> johnny
>
> Can you reproduce this? If you can, login as a separate user such as
> yourself or root and run something like:
> getent passwd faileduser at LDAP
> getent group groupthatfailedusershouldbein at LDAP

[root at www01:~]# getent passwd iambot at LDAP
iambot:*:10079:10022::/home/iambot:/bin/bash
[root at www01:~]# getent group staff at LDAP

Not sure what this means, but even the group for the
successfuluser at LDAP is blank. In fact, none of the LDAP groups return
anything.


> It might very well be something related to the cache cleanup bug I've
> ran into with that exact same version of sssd (RHEL 5.6 perhaps?)

CentOS-5.5, but sssd was almost certainly pulled from the 5.6 updates.

Do you have more info on this bug? Since you mention cache, I'm not
entirely sure if it's the same thing, as this faileduser hasn't yet
successfully auth'ed to this particular server, so it wouldn't be in
cache.

Thanks!
johnny



More information about the sssd-devel mailing list