[SSSD] - Issue with 1.8.0-32.el6 being on a different VLAN then active directory servers
Stephen Gallagher
sgallagh at redhat.com
Mon Aug 13 14:52:31 UTC 2012
On Mon, 2012-08-13 at 10:46 -0400, Derek Page wrote:
> Hi Devs,
>
> I am seeing an issue with sssd-1.8.0-32.el6.x86_64
>
> Issue description.
> When system is on a different VLAN as the Active directory servers
> logins are really slow or timeout and I see these errors.
>
> I see this in the syslog
> Aug 13 10:27:32 m4deploy01 sssd_be: GSSAPI Error: An invalid name was
> supplied (Unknown error)
>
From this log, it looks like you're getting referrals to Active
Directory servers that don't support GSSAPI binds (or don't support
allowing them from your particular host). As a workaround right now, I'd
strongly recommend setting 'ldap_referrals = False' on Active Directory
environments. AD mistreats referrals pretty badly and it results in poor
performance all-around.
I notice you have ldap_referrals = false present but commented-out.
Could that be the difference between your RHEL 5 and RHEL 6
environments?
> I see this in the sssd log
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_parse_entry] (0x4000): OriginalDN: [CN=Derek
> Page,OU=Concord,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
> [ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com]
> with fd [35].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
> [ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com]
> with fd [36].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
> [ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com] with fd
> [37].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
> (-2)[Local error]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x1000): Failed to bind to
> [ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
> with fd [37].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
> (-2)[Local error]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x1000): Failed to bind to
> [ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
> with fd [36].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed
> (-2)[Local error]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_rebind_proc] (0x1000): Failed to bind to
> [ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection
> with fd [35].
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_message] (0x4000): Message type:
> [LDAP_RES_SEARCH_REFERENCE]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_message] (0x4000): Message type:
> [LDAP_RES_SEARCH_REFERENCE]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_message] (0x4000): Message type:
> [LDAP_RES_SEARCH_REFERENCE]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1],
> ops[0x2194c10], ldap[0x31ae7b0]
> (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]]
> [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
> (Mon Aug 13 10:30:09 2012) [sssd[be[my.domain.com]]] [sbus_dispatch]
> (0x4000): dbus conn: 2163580
>
> If I moved the system to the same VLAN as the Active Directory servers
> and these errors go away and everything works great.
>
> Other systems running sssd-1.5.1-49.el5_8.1 on a different VLAN then
> my Active Directory servers also work great.
> Is this an issue with 1.8.0-32?
>
> Any suggestions?
>
>
> Here are my configs.
>
> #/etc/krb5.conf
> [logging]
> default = FILE:/var/log/krb5libs.log
> kdc = FILE:/var/log/krb5kdc.log
> admin_server = FILE:/var/log/kadmind.log
>
> [libdefaults]
> default_realm = MYDOMAIN.COM
> dns_lookup_realm = false
> dns_lookup_kdc = false
> ticket_lifetime = 24h
> renew_lifetime = 7d
> forwardable = true
> default_tgs_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
> default_tkt_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
> permitted_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
>
> [realms]
> MY.DOMAIN.COM = {
> kdc = ad.my.domain.com:88
> admin_server = ad.my.domain.com
> default_domain = my.domain.com
> }
>
> [domain_realm]
> .my.domain.com = MY.DOMAIN.COM
> my.domain.com = MY.DOMAIN.COM
>
>
>
>
> #/etc/sssd/sssd.conf
> [domain/default]
>
> cache_credentials = fasle
> [sssd]
> config_file_version = 2
> domains = my.domain.com
>
> reconnection_retries = 3
>
> sbus_timeout = 30
> services = nss, pam
>
> [nss]
> filter_groups = root
> filter_users = root
> reconnection_retries = 3
>
> [pam]
> reconnection_retries = 3
>
> [domain/my.domain.com]
> cache_credentials = false
> enumerate = false
> min_id = 80
> max_id = 30000
> id_provider = ldap
> auth_provider = krb5
> ldap_uri = ldap://ad3.my.domain.com/
> ldap_schema = rfc2307bis
> ldap_user_search_base = dc=my,dc=domain,dc=com
> ldap_user_object_class = person
> ldap_user_modify_timestamp = whenChanged
> ldap_user_home_directory = unixHomeDirectory
> ldap_user_shell = loginShell
> ldap_user_principal = userPrincipalName
> ldap_group_search_base = dc=my,dc=domain,dc=com
> ldap_group_object_class = group
> ldap_group_modify_timestamp = whenChanged
> ldap_group_nesting_level = 5
> ldap_account_expire_policy = ad
> ldap_sasl_authid = M4DEPLOY01$@MY.DOMAIN.COM
> ldap_krb5_init_creds = true
> ldap_pwd_policy = mit_kerberos
> chpass_provider = krb5
> ldap_sasl_mech = GSSAPI
> krb5_realm = MY.DOMAIN.COM
> krb5_validate = true
> ldap_user_name = sAMAccountName
> ldap_user_uid_number = uidNumber
> ldap_user_gid_number = gidNumber
> ldap_user_home_directory = unixHomeDirectory
> ldap_user_shell = loginShell
> ldap_user_principal = userPrincipalName
> ldap_group_object_class = group
> ldap_group_name = sAMAccountName
> ldap_group_gid_number = gidNumber
> ldap_force_upper_case_realm = true
> #ldap_referrals = false
>
> # User Group and Account Access
> access_provider = simple
> #simple_allow_users =
> simple_allow_groups = m4_login
>
> debug_level = 10
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120813/52f18bcb/attachment.sig>
More information about the sssd-devel
mailing list