[SSSD] Announcing SSSD 1.5.14

GOLLSCHEWSKY, Tim Tim.GOLLSCHEWSKY at suncorp.com.au
Tue Oct 25 06:27:29 UTC 2011


Hi Jan,

> > > > == sssd_XXX.XXX.XXX.log ==
> > > >
> > > > (Fri Oct 21 10:43:26 2011) [sssd[be[XXX.XXX.XXX]]] [main] (1):
> > > > Backend provider (XXX.XXX.XXX) started! (Fri Oct 21 10:43:36 2011)
> > > > [sssd[be[XXX.XXX.XXX]]] [main] (1): Backend provider (XXX.XXX.XXX)
> > > > started! (Fri Oct 21 10:43:47 2011) [sssd[be[XXX.XXX.XXX]]] [main]
> > > > (1): Backend provider (XXX.XXX.XXX) started!
> > >
> > > Is this really it in the backend log even with a high debug_level in
> > > the domain section if sssd.conf?
> > >
> > > Can you check if the back end is crashing? abrt would tell you or
> > > you'd see a message in the syslog.
> >
> > I think you are on to something, this was in /var/log/messages:
> >
> > Oct 21 16:45:40 jbsrd999586 kernel: sssd_be[14486]: segfault at 10 ip
> > 000000350a813eee sp 00007fff06f33130 error 4 in
> > libldap-2.4.so.2.5.2[350a800000+43000] Oct 21 16:45:40 jbsrd999586 kernel:
> > sssd_be[14486]: segfault at 10 ip 000000350a813eee sp 00007fff06f33130
> > error 4 in libldap-2.4.so.2.5.2[350a800000+43000]
> >
> > So looks like it's crashing.  :(
>
> This is interesting, I wonder how it happens. Could you send a core file? Or just an output of "bt full" from gdb if some > sensitive information can be in the core file. Feel free to ping me on IRC if you need any help with that.

I did some more testing and the crashing has gone away, in fact I can no longer reproduce that segfault which is a bit of a worry.  But no matter.

I've been playing around with packages in the RHEL6 beta channel as well as the v1.5.14 packages located here (http://jdennis.fedorapeople.org/ipa-devel/rhel/6/x86_64/os/) and I can consistently get this error in my syslog using either/both:

  Oct 25 15:59:06 jbsrd999586 sssd_be: GSSAPI Error: An invalid name was supplied (Unknown error)

So I'm at the same point I got stuck at when I was originally trying to upgrade my sssd (https://fedorahosted.org/pipermail/sssd-devel/2011-September/007007.html).  The ldap_sasl_bind is failing.

I'm not sure how to deal with an "unknown error".  I'm pretty sure my ldap_sasl_authid is correct (it matches my keytab file) but here's my config anyway:

  [sssd]
  config_file_version = 2
  sbus_timeout = 30
  services = nss, pam
  domains = XXX.XXX.XXX

  [nss]
  filter_groups = root
  filter_users = root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,midrange

  [pam]
  offline_credentials_expiration = 1
  [domain/XXX.XXX.XXX]
  enumerate = True
  ldap_id_use_start_tls = False
  cache_credentials = True
  id_provider = ldap
  auth_provider = krb5
  chpass_provider = krb5
  debug_level = 10

  ldap_schema = rfc2307bis
  ldap_force_upper_case_realm = True
  ldap_user_object_class = user
  ldap_group_object_class = group
  ldap_user_home_directory = unixHomeDirectory
  ldap_user_name = msSFU30Name
  ldap_user_member_of = msSFU30PosixMemberOf
  ldap_group_member = msSFU30PosixMember

  access_provider = ldap
  ldap_access_filter = memberOf=cn=accessgroup,ou=Right Groups,ou=Groups,dc=xxx,dc=xxx,dc=xxx

  ldap_uri = ldap://myadserver.xxx.xxx.xxx/
  ldap_search_base = dc=xxx,dc=xxx,dc=xxx
  ldap_user_search_base = ou=Accounts,dc=xxx,dc=xxx,dc=xxx
  ldap_group_search_base = ou=Right Groups,ou=Groups,dc=xxx,dc=xxx,dc=xxx
  ldap_sasl_mech = gssapi
  ldap_sasl_authid = host/myhost.xxx.xxx.xxx at XXX.XXX.XXX
  ldap_krb5_keytab = /etc/krb5.keytab
  ldap_krb5_init_creds = true
  ldap_tls_cacertdir = /etc/openldap/cacerts
  krb5_realm = XXX.XXX.XXX
  krb5_kpasswd = myadserver.xxx.xxx.xxx
  krb5_server = myadserver.xxx.xxx.xxx

Does anything look out of place?

Best regards,

Tim Gollschewsky.

This e-mail is sent by Suncorp Group Limited ABN 66 145 290 124 or one of its related entities "Suncorp".
Suncorp may be contacted at Level 18, 36 Wickham Terrace, Brisbane or on 13 11 55 or at suncorp.com.au.
The content of this e-mail is the view of the sender or stated author and does not necessarily reflect the view of Suncorp. The content, including attachments, is a confidential communication between Suncorp and the intended recipient. If you are not the intended recipient, any use, interference with, disclosure or copying of this e-mail, including attachments, is unauthorised and expressly prohibited. If you have received this e-mail in error please contact the sender immediately and delete the e-mail and any attachments from your system.



More information about the sssd-devel mailing list