[SSSD] Active Directory integration issues
Rolf Loudon
kalischt at gmail.com
Wed Mar 21 22:10:26 UTC 2012
Hello
Thanks. Yes ticket 1269 sounds like the behaviour. I presume i could prove this by creating a key tab with only a single principal in it and point sssd to it with krb5_key = and that is a workaround?
Sending logs separately.
r.
On 22/03/2012, at 12:57 AM, Stephen Gallagher wrote:
> On Wed, 2012-03-21 at 17:05 +1100, Rolf Loudon wrote:
> ...
>> Firstly the logs tell me that the principal is not found in the KDC
>> database. But when I inspect it using ADSI Edit I see the SPN and UPN
>> values that I expect to see and that match the principal it says it
>> cannot find. Likewise these principals can be seen from klist -kte
>> /etc/krb5/keytab (though it doesn't complain about not finding
>> anything in the key tab)
>>
>> I can get round that issue temporarily by specifying the principal name
>> using ldap_sasl_authid. I'd still like to know what is wrong in that
>> instance.
>>
>
> I'm guessing you're likely hitting
> https://fedorahosted.org/sssd/ticket/1269
>
> We're going to try to fix that for the 1.8.2 release, so it should get
> pulled into Ubuntu 12.04 LTS as a bugfix eventually.
>>
>> Secondly the ldap_search_base strangely affects the authentication and
>> the user lookup. I don't know if the searching is subtree or not. I
>> can't see a parameter to make this explicit.
>>
>
> Searches are always SUBTREE by default (in 1.5.x I don't think this was
> even optional). The correct behavior *should* be to use the
> dc=domainpart1,dc=domainpart2,dc=domainpart3
>
>> If I set ldap_search_base (or ldap_user_search_base) to
>> dc=domainpart1,dc=domainpart2,dc=domainpart3 then I get errors about
>> ldap_sasl_interactive_bind_s failing. however if I set the
>> ldap_search_base to
>> cn=users,dc=domainpart1,dc=domainpart2,dc=domainpart3 then those
>> errors go away and the lookup is done.
>>
>
> Can you please set 'debug_level = 6' in the [domain/DOMAINNAME] section
> of sssd.conf, restart SSSD, try this and then send the (sanitized) logs
> to me? If the SASL bind is failing where the user lookups are working
> properly, then it's most likely a bug and we need logs to figure out
> where the failure is happening.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
More information about the sssd-devel
mailing list