[SSSD] Unable to resolv netgroup with sssd

Mathieu Bouillaguet mathieu.bouillaguet at gmail.com
Fri Jul 5 13:54:57 UTC 2013


Hello,

We are trying to get sssd to resolv netgroups. Our goal is to be able to
specify group of hosts in sudo rules. The sudo configuration is held in the
Active Directory DC. The only way to do that in our environment seems to be
by using host netgroups.

We use Red Hat 6.2, the sssd version is 1.5.1.-66.el6.

We have a working configuration with auth_provider=krb5, id_provider=ldap
and access_provider=ldap.

In nsswitch.conf passwd, group and shadow have "files sss" and getent
return the expected information.

For netgroup, I have also put "files sss" but I cannot resolv any netgroup.

When I type : getent netgroup -s sss <NetGroup>
I see the following logs in sssd_nss.log :

(Fri Jul  5 15:48:04 2013) [sssd[nss]] [sbus_dispatch] (9): dbus conn:
6560B0
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [sbus_dispatch] (9): Dispatching.
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [sbus_message_handler] (9): Received
SBUS method [ping]
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [get_client_cred] (9): Client creds:
euid[0] egid[0] pid[18938].
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [accept_fd_handler] (4): Client
connected!
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [sss_cmd_get_version] (5): Received
client version [1].
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [sss_cmd_get_version] (5): Offered
version [1].
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [setnetgrent_send] (4): Requesting
info for netgroup [Linux.Global] from [<ALL>]
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [sss_ncache_check_str] (8): Checking
negative cache for [NCE/NETGR/LOCAL/Linux.Global]
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [lookup_netgr_step] (4): Requesting
info for [Linux.Global at LOCAL]
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [ldb] (9): tevent: Added timed event
"ltdb_callback": 0x65dc80
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [ldb] (9): tevent: Added timed event
"ltdb_timeout": 0x652170
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [ldb] (9): tevent: Destroying timer
event 0x652170 "ltdb_timeout"
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [ldb] (9): tevent: Ending timer
event 0x65dc80 "ltdb_callback"
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [lookup_netgr_step] (2): No matching
domain found for [Linux.Global], fail!
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [nss_cmd_setnetgrent] (0): Fatal
error calling setnetgrent_send
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [client_recv] (5): Client
disconnected!
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [get_client_cred] (9): Client creds:
euid[0] egid[0] pid[18938].
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [accept_fd_handler] (4): Client
connected!
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [sss_cmd_get_version] (5): Received
client version [1].
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [sss_cmd_get_version] (5): Offered
version [1].
(Fri Jul  5 15:48:04 2013) [sssd[nss]] [client_recv] (5): Client
disconnected!
(Fri Jul  5 15:48:14 2013) [sssd[nss]] [sbus_dispatch] (9): dbus conn:
6560B0
(Fri Jul  5 15:48:14 2013) [sssd[nss]] [sbus_dispatch] (9): Dispatching.
(Fri Jul  5 15:48:14 2013) [sssd[nss]] [sbus_message_handler] (9): Received
SBUS method [ping]
(Fri Jul  5 15:48:24 2013) [sssd[nss]] [sbus_dispatch] (9): dbus conn:
6560B0
(Fri Jul  5 15:48:24 2013) [sssd[nss]] [sbus_dispatch] (9): Dispatching.
(Fri Jul  5 15:48:24 2013) [sssd[nss]] [sbus_message_handler] (9): Received
SBUS method [ping]

Notably, I can see that it appears as if sssd cannot find the right domain
to query netgroups.

This is strange since user and group resolv fine and the configuration is
shared for user, groups and netgroup resolving.

The sssd.cofn is attached.

Do you see anything that could break netgroup resolution ?
Thanks in advance
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130705/01df66ba/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd.conf.anon
Type: application/octet-stream
Size: 2472 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130705/01df66ba/attachment.obj>


More information about the sssd-devel mailing list