[SSSD] sssd ldaps issue on Gentoo

Dmitri Pal dpal at redhat.com
Wed Oct 10 15:23:31 UTC 2012


On 10/10/2012 10:48 AM, Aziz Sasmaz wrote:
> Yes
>
> On Wed, Oct 10, 2012 at 3:24 PM, Jakub Hrozek <jhrozek at redhat.com
> <mailto:jhrozek at redhat.com>> wrote:
>
>     On Wed, Oct 10, 2012 at 02:42:03PM +0300, Aziz Sasmaz wrote:
>     > On Wed, Oct 10, 2012 at 11:37 AM, Jakub Hrozek
>     <jhrozek at redhat.com <mailto:jhrozek at redhat.com>> wrote:
>     >
>     > > On Wed, Oct 10, 2012 at 10:34:46AM +0300, Aziz Sasmaz wrote:
>     > > > Hi,
>     > > >
>     > > > I use sssd on all servers in our infrastruceture.  Most of
>     them Redhat,
>     > > > Centos and debian. It works very well with these OSes.
>     > > >  And we have some gentoo linux machines.  I had  some
>     difficulties
>     > > > configuring sssd when I want to use ldaps
>     > > >
>     > > > [domain/LDAP]
>     > > > id_provider = ldap
>     > > > auth_provider = ldap
>     > > > chpass_provider = ldap
>     > > > ldap_schema = rfc2307
>     > > > ldap_uri = ldaps://ldap.xxx.com <http://ldap.xxx.com>
>     > > > ldap_chpass_uri = ldaps://ldap-provider.xxx.com
>     <http://ldap-provider.xxx.com>
>     > > > ldap_search_base = dc=xxx,dc=com
>     > > > ldap_tls_reqcert = allow
>     > > > cache_credentials = true
>     > > > enumerate = true
>     > > > entry_cache_timeout = 5400
>     > > > ldap_user_gecos = uid
>     > > >
>     > > > When I use ldap_uri = ldap   or  ldap_uri = ldaps  getent
>     works, but
>     > > logins
>     > > > are not working. There are interesting entries in log files;
>     > > >
>     > > > sssd_LDAP
>     > > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_new_service]
>     (0x0080):
>     > > > Creating new service 'LDAP'
>     > > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_add_server]
>     (0x0080):
>     > > > Adding new server 'ldap.xxx.com <http://ldap.xxx.com>', to
>     service 'LDAP'
>     > > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_new_service]
>     (0x0080):
>     > > > Creating new service 'LDAP_CHPASS'
>     > > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [fo_add_server]
>     (0x0080):
>     > > > Adding new server 'ldap-provider.xxx.com
>     <http://ldap-provider.xxx.com>', to service 'LDAP_CHPASS'
>     > > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
>     [sssm_ldap_sudo_init]
>     > > (0x0080):
>     > > > Sudo init handler called but SSSD is built without sudo
>     support, ignoring
>     > > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
>     [sssm_ldap_autofs_init]
>     > > > (0x0080): Autofs init handler called but SSSD is built
>     without autofs
>     > > > support, ignoring
>     > > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
>     [be_process_init] (0x0020):
>     > > No
>     > > > Session module provided for [LDAP] !!
>     > > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
>     [be_process_init] (0x0020):
>     > > No
>     > > > host info module provided for [LDAP] !!
>     > > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]] [main] (0x0020):
>     Backend
>     > > > provider (LDAP) started!
>     > > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
>     [sdap_sys_connect_done]
>     > > > (0x0080): Failed to set LDAP SASL nocanon option to true. If
>     your system
>     > > is
>     > > > configured to use SASL, LDAP operations might fail.
>     > > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
>     [simple_bind_done] (0x0080):
>     > > > Bind result: Success(0), no errmsg set
>     > > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
>     [sdap_process_group_send]
>     > > > (0x0040): No Members. Done!
>     > > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
>     [sdap_process_group_send]
>     > > > (0x0040): No Members. Done!
>     > > >
>     > > > sssd_nss
>     > > > (Wed Oct 10 09:58:24 2012) [sssd[nss]]
>     [nss_dp_reconnect_init] (0x0010):
>     > > > Could not reconnect to LDAP provider.
>     > > > (Wed Oct 10 09:58:54 2012) [sssd[nss]] [sbus_reconnect]
>     (0x0080): Making
>     > > > reconnection attempt 8 to
>     > > > [unix:path=/var/lib/sss/pipes/private/sbus-dp_LDAP]
>     > > > (Wed Oct 10 09:58:54 2012) [sssd[nss]] [sbus_reconnect]
>     (0x0020): Failed
>     > > to
>     > > > open connection: name=org.freedesktop.DBus.Error.NoServer,
>     message=Failed
>     > > > to connect to socket
>     /var/lib/sss/pipes/private/sbus-dp_LDAP: Connection
>     > > > refused
>     > > >
>     > > > sssd_pam
>     > > > (Wed Oct 10 09:59:24 2012) [sssd[pam]]
>     [pam_dp_reconnect_init] (0x0010):
>     > > > Could not reconnect to LDAP provider.
>     > > > (Wed Oct 10 09:59:54 2012) [sssd[pam]] [sbus_reconnect]
>     (0x0080): Making
>     > > > reconnection attempt 10 to
>     > > > [unix:path=/var/lib/sss/pipes/private/sbus-dp_LDAP]
>     > > > (Wed Oct 10 09:59:54 2012) [sssd[pam]] [sbus_reconnect]
>     (0x0020): Failed
>     > > to
>     > > > open connection: name=org.freedesktop.DBus.Error.NoServer,
>     message=Failed
>     > > > to connect to socket
>     /var/lib/sss/pipes/private/sbus-dp_LDAP: Connection
>     > > > refused
>     > > >
>     > > > It says  connection refused but there is no network issue
>     with ldap
>     > > > servers, all ports opened. Could you pleasegive me advice
>     resolving this
>     > > > issue?
>     > > >
>     > > > Thanks,
>     > > >
>     > > > AS
>     > >
>     > > Hi,
>     > >
>     > > the Connection Refused message does not describe a connection
>     to the
>     > > server but rather connection via unix sockets between
>     different parts of
>     > > the SSSD. Can you check the following for me?
>     > >
>     > > 1) ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP
>     > > It should be a symlink pointing to
>     > > /var/lib/sss/pipes/private/sbus-dp_LDAP.$PID where $PID should
>     > > correspond to the PID number of the sssd_be process.
>     > >
>     > > 2) Does restart of the SSSD clear things up?
>     > >
>     > > 3) If not, can you paste or attache the DEBUG messages that
>     the SSSD
>     > > prints after startup?
>     > > _______________________________________________
>     > > sssd-devel mailing list
>     > > sssd-devel at lists.fedorahosted.org
>     <mailto:sssd-devel at lists.fedorahosted.org>
>     > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>     > >
>     >
>     >
>     > Yes there is symbolic link for that.
>     >
>     > root at admin01 ~#  ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP
>     > lrwxrwxrwx 1 root root 45 2012-10-10 10:29
>     > /var/lib/sss/pipes/private/sbus-dp_LDAP ->
>     > /var/lib/sss/pipes/private/sbus-dp_LDAP.31432
>     >
>
>     is 31432 a PID of your sssd_be process? If you issue:
>     ps -axu | grep sssd_be
>     there should be a sssd_be process running with parameter --domain
>     LDAP.
>
>     Is there anything interesting in /var/log/sssd_LDAP.log ?
>     _______________________________________________
>     sssd-devel mailing list
>     sssd-devel at lists.fedorahosted.org
>     <mailto:sssd-devel at lists.fedorahosted.org>
>     https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
>
> Hi,
>
> Yes it'is the same number as pid. As you can see;
>
> root at admin01 ~# ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP
> lrwxrwxrwx 1 root root 45 2012-10-10 14:54
> /var/lib/sss/pipes/private/sbus-dp_LDAP ->
> /var/lib/sss/pipes/private/sbus-dp_LDAP.32375
>
> root at admin01 ~# ps -fe |grep sssd_be
> root     32375 32374  0 14:54 ?        00:00:05
> /usr/libexec/sssd/sssd_be --domain LDAP -d 0x00f0 --debug-to-files
>
> sssd_LDAP.log  is below;
>
> (Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_new_service] (0x0080):
> Creating new service 'LDAP'
> (Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_add_server] (0x0080):
> Adding new server 'ldap.bilyoner.com <http://ldap.bilyoner.com>', to
> service 'LDAP'
> (Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_new_service] (0x0080):
> Creating new service 'LDAP_CHPASS'
> (Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_add_server] (0x0080):
> Adding new server 'ldap-provider.bilyoner.com
> <http://ldap-provider.bilyoner.com>', to service 'LDAP_CHPASS'
> (Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [sssm_ldap_sudo_init]
> (0x0080): Sudo init handler called but SSSD is built without sudo
> support, ignoring
> (Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [sssm_ldap_autofs_init]
> (0x0080): Autofs init handler called but SSSD is built without autofs
> support, ignoring
> (Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [be_process_init]
> (0x0020): No Session module provided for [LDAP] !!
> (Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [be_process_init]
> (0x0020): No host info module provided for [LDAP] !!
> (Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [main] (0x0020): Backend
> provider (LDAP) started!
> (Wed Oct 10 14:53:45 2012) [sssd[be[LDAP]]] [sdap_sys_connect_done]
> (0x0080): Failed to set LDAP SASL nocanon option to true. If your
> system is configured to use SASL, LDAP operations might fail.
>

Can it be that underlying ldap library does not support SASL bind or the
option that we are trying to set?


>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121010/0fe423b2/attachment.html>


More information about the sssd-devel mailing list