[SSSD] debbuging, how to turn off cache [SOLVED]

steve steve at steve-ss.com
Fri Apr 19 16:57:42 UTC 2013


On 04/19/2013 06:33 PM, steve wrote:
> On 04/19/2013 05:51 PM, Jakub Hrozek wrote:
>> On Fri, Apr 19, 2013 at 04:48:15PM +0200, steve wrote:
>>> Hi
>>> The LDAP_PROTOCOL_ERROR occurs once during user authentication and
>>> again upon logging out. It does not occur with getent or at ny other
>>> time during the session. I'm almost certain that this has something
>>> to do with sssd; users authenticating against nslcd or winbind do
>>> not produce this response from the Samba4 ldap. I'll post over on
>>> samba-technical to see if they can help.
>>> Cheers,
>>> Steve
>> Yes, but can you post the relevent snippet from the logs? They should
>> include the query that is failing.
> Hi
> I put the level 9 logs here:
> https://dl.dropboxusercontent.com/u/45150875/sssd.client.log.tar
>
> I'm not a dev but I'll try: Here is where it fails getting the groups 
> for the user (from sssd_default.log) I think that this is what 
> produces the LDAP_PROTOCOL_ERROR.
>
>  (0x4000): Process user's groups
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_initgr_rfc2307bis_next_base] (0x0400): Searching for parent 
> groups for user [CN=steve3,CN=Users,DC=dolores,DC=site] with base 
> [dc=dolores,dc=site]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with 
> [(&(member=CN=steve3,CN=Users,DC=dolores,DC=site)(objectclass=group)(cn=*))][dc=dolores,dc=site]. 
>
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsUniqueId]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 23
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result] 
> (0x2000): Trace: sh[0x893d088], connected[1], ops[0x895ef58], 
> ldap[0x8933328]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result] 
> (0x2000): Trace: ldap_result found nothing!
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result] 
> (0x2000): Trace: sh[0x893d088], connected[1], ops[0x895ef58], 
> ldap[0x8933328]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] 
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to 
> [ldap://dolores.site/CN=Configuration,DC=dolores,DC=site] with fd [22].
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_rebind_proc] 
> (0x1000): Successfully bind to 
> [ldap://dolores.site/CN=Configuration,DC=dolores,DC=site].
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_message] 
> (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result] 
> (0x2000): Trace: sh[0x893d088], connected[1], ops[0x895ef58], 
> ldap[0x8933328]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_message] 
> (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result] 
> (0x2000): Trace: sh[0x893d088], connected[1], ops[0x895ef58], 
> ldap[0x8933328]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_message] 
> (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result] 
> (0x2000): Trace: sh[0x893d088], connected[1], ops[0x895ef58], 
> ldap[0x8933328]
> (Fri Apr 19 07:09:10 2013) [sssd[be[default]]] [sdap_process_result] 
> (0x0040): ldap_result error: [Can't contact LDAP server]

Hi. Not sure I've got the right ldapsearch syntax, but the filter from 
sssd gives an error:

  sudo ldapsearch -h doloresdc.dolores.site -b 'dc=dolores,dc=site' 
'[(&(member=CN=steve3,CN=Users,DC=dolores,DC=site)(objectclass=group)(cn=*))][dc=dolores,dc=site]' 
-Y GSSAPI
SASL/GSSAPI authentication started
SASL username: Administrator at DOLORES.SITE
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=dolores,dc=site> with scope subtree
# filter: 
[(&(member=CN=steve3,CN=Users,DC=dolores,DC=site)(objectclass=group)(cn=*))][dc=dolores,dc=site]
# requesting: ALL
#
ldap_search_ext: Bad search filter (-7)




More information about the sssd-devel mailing list