[SSSD] - Issue with 1.8.0-32.el6 being on a different VLAN then active directory servers

Stephen Gallagher sgallagh at redhat.com
Mon Aug 13 14:52:31 UTC 2012


On Mon, 2012-08-13 at 10:46 -0400, Derek Page wrote:
> Hi Devs,
> 
> I am seeing an issue with sssd-1.8.0-32.el6.x86_64
> 
> Issue description.
> When system is on a different VLAN as the Active directory servers
> logins are really slow or timeout and I see these errors.
> 
> I see this in the syslog
> Aug 13 10:27:32 m4deploy01 sssd_be: GSSAPI Error: An invalid name was
> supplied (Unknown error)
> 

From this log, it looks like you're getting referrals to Active
Directory servers that don't support GSSAPI binds (or don't support
allowing them from your particular host). As a workaround right now, I'd
strongly recommend setting 'ldap_referrals = False' on Active Directory
environments. AD mistreats referrals pretty badly and it results in poor
performance all-around.

I notice you have ldap_referrals = false present but commented-out.
Could that be the difference between your RHEL 5 and RHEL 6
environments?

> I see this in the sssd log
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_parse_entry] (0x4000): OriginalDN: [CN=Derek
> Page,OU=Concord,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
> [ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com]
> with fd [35].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
> [ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com]
> with fd [36].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
> [ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com] with fd
> [37].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
> (-2)[Local error]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x1000): Failed to bind to
> [ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
> with fd [37].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
> (-2)[Local error]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x1000): Failed to bind to
> [ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
> with fd [36].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
> (-2)[Local error]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x1000): Failed to bind to
> [ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
> with fd [35].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_message] (0x4000): Message type:
> [LDAP_RES_SEARCH_REFERENCE]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_message] (0x4000): Message type:
> [LDAP_RES_SEARCH_REFERENCE]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_message] (0x4000): Message type:
> [LDAP_RES_SEARCH_REFERENCE]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
> (Mon Aug 13 10:30:09 2012) [sssd[be[my.domain.com]]] [sbus_dispatch]
> (0x4000): dbus conn: 2163580
> 
> If I moved the system to the same VLAN as the Active Directory servers
> and these errors go away and everything works great.
> 
> Other systems running sssd-1.5.1-49.el5_8.1 on a different VLAN then
> my Active Directory servers also work great.
> Is this an issue with 1.8.0-32?
> 
> Any suggestions?
> 
> 
> Here are my configs.
> 
> #/etc/krb5.conf
> [logging]
>  default = FILE:/var/log/krb5libs.log
>  kdc = FILE:/var/log/krb5kdc.log
>  admin_server = FILE:/var/log/kadmind.log
> 
> [libdefaults]
>  default_realm = MYDOMAIN.COM
>  dns_lookup_realm = false
>  dns_lookup_kdc = false
>  ticket_lifetime = 24h
>  renew_lifetime = 7d
>  forwardable = true
>  default_tgs_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
>  default_tkt_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
>  permitted_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
> 
> [realms]
>   MY.DOMAIN.COM = {
>   kdc = ad.my.domain.com:88
>   admin_server = ad.my.domain.com
>   default_domain = my.domain.com
>  }
> 
> [domain_realm]
>  .my.domain.com = MY.DOMAIN.COM
>  my.domain.com = MY.DOMAIN.COM
> 
> 
> 
> 
> #/etc/sssd/sssd.conf
> [domain/default]
> 
> cache_credentials = fasle
> [sssd]
> config_file_version = 2
> domains = my.domain.com
> 
> reconnection_retries = 3
> 
> sbus_timeout = 30
> services = nss, pam
> 
> [nss]
> filter_groups = root
> filter_users = root
> reconnection_retries = 3
> 
> [pam]
> reconnection_retries = 3
> 
> [domain/my.domain.com]
> cache_credentials = false
> enumerate = false
> min_id = 80
> max_id = 30000
> id_provider = ldap
> auth_provider = krb5
> ldap_uri = ldap://ad3.my.domain.com/
> ldap_schema = rfc2307bis
> ldap_user_search_base = dc=my,dc=domain,dc=com
> ldap_user_object_class = person
> ldap_user_modify_timestamp = whenChanged
> ldap_user_home_directory = unixHomeDirectory
> ldap_user_shell = loginShell
> ldap_user_principal = userPrincipalName
> ldap_group_search_base = dc=my,dc=domain,dc=com
> ldap_group_object_class = group
> ldap_group_modify_timestamp = whenChanged
> ldap_group_nesting_level = 5
> ldap_account_expire_policy = ad
> ldap_sasl_authid = M4DEPLOY01$@MY.DOMAIN.COM
> ldap_krb5_init_creds = true
> ldap_pwd_policy = mit_kerberos
> chpass_provider = krb5
> ldap_sasl_mech = GSSAPI
> krb5_realm = MY.DOMAIN.COM
> krb5_validate = true
> ldap_user_name = sAMAccountName
> ldap_user_uid_number = uidNumber
> ldap_user_gid_number = gidNumber
> ldap_user_home_directory = unixHomeDirectory
> ldap_user_shell = loginShell
> ldap_user_principal = userPrincipalName
> ldap_group_object_class = group
> ldap_group_name = sAMAccountName
> ldap_group_gid_number = gidNumber
> ldap_force_upper_case_realm = true
> #ldap_referrals = false
> 
> # User Group and Account Access
> access_provider = simple
> #simple_allow_users =
> simple_allow_groups = m4_login
> 
> debug_level = 10
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120813/52f18bcb/attachment.sig>


More information about the sssd-devel mailing list