[SSSD] Trying to get id proxy to work
Jakub Hrozek
jhrozek at redhat.com
Thu Oct 18 17:33:09 UTC 2012
On Thu, Oct 18, 2012 at 01:43:30PM +0000, Joshua C. Endries wrote:
> Hi Jakub,
>
> Thanks for the response! I'm using Outlook so the quoting is manual, sorry for that.
>
> > Yep, pam_sss claims it doesn't know the user.
> >
> > Is "sss" included on the "passwd" and "group" lines of /etc/nsswitch.conf?
>
> So does this mean that sssd is talking to PAM, which is then talking to NSS? Yes, "sss" is in nsswitch.conf:
>
Yes, pretty much. The PAM responder of the SSSD depends on the user entry
being available via the SSSD.
> passwd: files sss
> shadow: files
> group: files sss
>
> > Does "getent passwd -s sss jce54" work?
>
> Nope. I tested this after Googling, and it just returns without any output. IIRC, the return code was 2, but I'd have to re-test it (which means dismantling the working auth, starting my sessions, re-enabling sssd)...
>
OK, this seems to be the problem. The return code 2 would be expected as
it means ENOENT (No such file or directory).
Let's try to get to the root of the problem:
1. can you try raising the debug_level of the [nss] responder and
also the domain? Put:
debug_level = 7
into the [nss] and [domain/DEFAULT] sections, restart the SSSD and
re-run getent passwd -s sss jce54. Can you then paste the contents
of /var/log/sssd/sssd_nss.log and /var/log/sssd/sssd_DEFAULT.log ?
2. If there is nothing relevant especially in the sssd_nss.log, can
you try checking if getent opens the NSS module at all? Run:
strace -e open getent passwd -s sss jce54
3. Are there any AVC denials?
More information about the sssd-devel
mailing list