[SSSD] new ldap users inconsistently able to auth on existing servers

Jeff Schroeder jeffschroeder at computer.org
Fri Jun 17 22:15:51 UTC 2011


On Fri, Jun 17, 2011 at 2:46 PM, Johnny Tan <jt at renttherunway.com> wrote:
> On Fri, Jun 17, 2011 at 5:37 PM, Jeff Schroeder
> <jeffschroeder at computer.org> wrote:
>> On Fri, Jun 17, 2011 at 2:12 PM, Johnny Tan <jt at renttherunway.com> wrote:
>>> I recently setup sssd (sssd-1.2.1-39.el5) in our environment. We have
>>> an LDAP server running openldap-servers-2.3.43-12.el5_5.2.x86_64.
>>>
>>> It seems that certain users can't authenticate to certain servers. All
>>> servers have identical sssd.conf, nsswitch.conf, and system-auth-ac
>>> files (pushed by puppet). I haven't yet found a pattern as to which
>>> users and which servers, as it seems to be random.
>> ... snip ...
>>
>>> My own hypothesis is that the successful auth is using cached
>>> credentials (since jt has logged in previously), but the failed one is
>>> from a user that has not successfully logged into the server. But if
>>> I'm correct, what I don't get is why sssd cannot pull information from
>>> the LDAP provider. It's online and serving out requests, and the
>>> failed user on this machine has successfully logged in for the first
>>> time on a couple other servers in the same timeframe.
>>>
>>> Thoughts?
>>> johnny
>>
>> Can you reproduce this? If you can, login as a separate user such as
>> yourself or root and run something like:
>> getent passwd faileduser at LDAP
>> getent group groupthatfailedusershouldbein at LDAP
>
> [root at www01:~]# getent passwd iambot at LDAP
> iambot:*:10079:10022::/home/iambot:/bin/bash
> [root at www01:~]# getent group staff at LDAP
>
> Not sure what this means, but even the group for the
> successfuluser at LDAP is blank. In fact, none of the LDAP groups return
> anything.
>
>
>> It might very well be something related to the cache cleanup bug I've
>> ran into with that exact same version of sssd (RHEL 5.6 perhaps?)
>
> CentOS-5.5, but sssd was almost certainly pulled from the 5.6 updates.
>
> Do you have more info on this bug? Since you mention cache, I'm not
> entirely sure if it's the same thing, as this faileduser hasn't yet
> successfully auth'ed to this particular server, so it wouldn't be in
> cache.

https://bugzilla.redhat.com/show_bug.cgi?id=675007

-- 
Jeff Schroeder

Don't drink and derive, alcohol and analysis don't mix.
http://www.digitalprognosis.com



More information about the sssd-devel mailing list