[SSSD] auth.log error message: _sasl_plugin_load failed on sasl_canonuser_init for plugin: ldapdb

Qing Chang qchang at sri.utoronto.ca
Wed Nov 13 21:19:03 UTC 2013


there was a thread on Aug 8, 2013 that was about this error, my situation is
a little different. This happens on Ubuntu 12.04 IPA clients, which automounts
kerberized NFSv4.

I am let to believe that this error may be the cause of a weird problem that
users are able to login wither per ssh or lightdm.

Open an ssh session, type in username and password,  successful authentication
is logged in auth.log, but the session just hangs at the login prompt.
=====
Nov 13 09:52:33 murjo sshd[2746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 
tty=ssh ruser= rhost=fish  user=qchang
Nov 13 09:52:34 murjo sshd[2746]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 
tty=ssh ruser= rhost=fish user=qchang
Nov 13 09:52:34 murjo sshd[2746]: Accepted password for qchang from port 33621 ssh2
Nov 13 09:52:34 murjo sshd[2746]: pam_unix(sshd:session): session opened for user qchang by (uid=0)
Nov 13 09:53:04 murjo sssd_be: canonuserfunc error -7
Nov 13 09:53:04 murjo sssd_be: _sasl_plugin_load failed on sasl_canonuser_init for plugin: ldapdb
Nov 13 09:57:23 murjo sshd[902]: Received signal 15; terminating.
Nov 13 09:57:23 murjo sshd[997]: Server listening on 0.0.0.0 port 22.
Nov 13 09:57:23 murjo sshd[997]: Server listening on :: port 22.
Nov 13 09:57:34 murjo lightdm: pam_unix(lightdm:session): session opened for user lightdm by (uid=0)
Nov 13 09:57:34 murjo lightdm: pam_ck_connector(lightdm:session): nox11 mode, ignoring PAM_TTY :0
Nov 13 09:57:35 murjo dbus[910]: [system] Rejected send message, 2 matched rules; 
type="method_call", sender=":1.16" (uid=104 pid=1554 comm="/usr/lib/indicator-datetim
e/indicator-datetime-ser") interface="org.freedesktop.DBus.Properties" member="GetAll" error 
name="(unset)" requested_reply="0" destination=":1.9" (uid=0 pid=1400 comm
="/usr/sbin/console-kit-daemon --no-daemon ")
Nov 13 09:57:43 murjo automount[1725]: canonuserfunc error -7
Nov 13 09:57:43 murjo automount[1725]: _sasl_plugin_load failed on sasl_canonuser_init for plugin: 
ldapdb
Nov 13 09:57:44 murjo automount[1725]: DIGEST-MD5 common mech free
Nov 13 09:57:44 murjo automount[1725]: canonuserfunc error -7
=====

It is probably because my home is not available at the time when auth.log says session
opened for me. I have no problem login as a local user ID with local home. Maybe SSSD
did not provide information for automount to make my home available? At the end,
after I run sudo ls -l /home as the local user, the ssh session came alive.

The strangest thing is this seems to happen randomly in terms of what host and what
time! I have a group of people on Ubuntu 12.04 calling me at different times every few
days and I have to try all kind of things to get them back, the latest is that sudo ls -l
"trick" and can not tell them for sure what is the problem:-(

Note this _never_ happens on CentOS/RHEL clients. I know, I wish I can convert them...

Please help.

SSSD information:
=====
root at host:/var/log# aptitude show sssd
Package: sssd
State: installed
Automatically installed: yes
Version: 1.8.6-0ubuntu0.3
Priority: extra
Section: universe/utils
Maintainer: Ubuntu Core Developers <ubuntu-devel at lists.ubuntu.com>
Architecture: amd64
Uncompressed Size: 7,978 k
Depends: libc-ares2 (>= 1.7.0), libc6 (>= 2.14), libdbus-1-3 (>= 1.1.1), libdhash1, libini-config2, 
libipa-hbac0 (= 1.8.6-0ubuntu0.3), libk5crypto3 (>= 1.6.dfsg.2),
          libkrb5-3 (>= 1.9+dfsg~beta1), libldap-2.4-2 (>= 2.4.7), libldb1 (>= 0.9.21), libnspr4 (>= 
1.8.0.10), libnss3 (>= 3.12.0~1.9b1), libpam0g (>= 0.99.7.1),
          libpcre3 (>= 8.10), libpopt0 (>= 1.14), libtalloc2 (>= 2.0.4~git20101213), libtdb1 (>= 
1.2.7+git20101214), libtevent0 (>= 0.9.9), libunistring0, upstart-job,
          python, python-sss
PreDepends: multiarch-support
Recommends: ldap-utils, bind9-host, libnss-sss, libpam-sss, libsasl2-modules-gssapi-mit | 
libsasl2-modules-gssapi-heimdal, libsasl2-modules-ldap
Suggests: sssd-tools
Conflicts: sssd
Description: System Security Services Daemon
  Provides a set of daemons to manage access to remote directories and authentication mechanisms. It 
provides an NSS and PAM interface toward the system and a pluggable
  backend system to connect to multiple different account sources. It is also the basis to provide 
client auditing and policy services for projects like FreeIPA.

  This package provides the daemon.
Homepage: https://fedorahosted.org/sssd/
=====

Thanks,
Qing Chang

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20131113/25fd1392/attachment.html>


More information about the sssd-devel mailing list