[SSSD] Active Directory integration issues

Rolf Loudon kalischt at gmail.com
Wed Mar 21 22:10:26 UTC 2012


Hello

Thanks.  Yes ticket 1269 sounds like the behaviour.  I presume i could prove this by creating a key tab with only a single principal in it and point sssd to it with krb5_key = and that is a workaround?

Sending logs separately.

r.

On 22/03/2012, at 12:57 AM, Stephen Gallagher wrote:

> On Wed, 2012-03-21 at 17:05 +1100, Rolf Loudon wrote:
> ...
>> Firstly the logs tell me that the principal is not found in the KDC
>> database.  But when I inspect it using ADSI Edit I see the SPN and UPN
>> values that I expect to see and that match the principal it says it
>> cannot find.  Likewise these principals can be seen from klist -kte
>> /etc/krb5/keytab  (though it doesn't complain about not finding
>> anything in the key tab)
>> 
>> I can get round that issue temporarily by specifying the principal name
>> using ldap_sasl_authid.  I'd still like to know what is wrong in that
>> instance.
>> 
> 
> I'm guessing you're likely hitting 
> https://fedorahosted.org/sssd/ticket/1269
> 
> We're going to try to fix that for the 1.8.2 release, so it should get
> pulled into Ubuntu 12.04 LTS as a bugfix eventually.
>> 
>> Secondly the ldap_search_base strangely affects the authentication and
>> the user lookup.  I don't know if the searching is subtree or not.  I
>> can't see a parameter to make this explicit.
>> 
> 
> Searches are always SUBTREE by default (in 1.5.x I don't think this was
> even optional). The correct behavior *should* be to use the
> dc=domainpart1,dc=domainpart2,dc=domainpart3
> 
>> If I set ldap_search_base (or ldap_user_search_base)  to
>> dc=domainpart1,dc=domainpart2,dc=domainpart3  then I get errors about
>> ldap_sasl_interactive_bind_s failing. however if I set the
>> ldap_search_base to
>> cn=users,dc=domainpart1,dc=domainpart2,dc=domainpart3  then those
>> errors go away and the lookup is done.
>> 
> 
> Can you please set 'debug_level = 6' in the [domain/DOMAINNAME] section
> of sssd.conf, restart SSSD, try this and then send the (sanitized) logs
> to me? If the SASL bind is failing where the user lookups are working
> properly, then it's most likely a bug and we need logs to figure out
> where the failure is happening.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list