<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 10/10/2012 10:48 AM, Aziz Sasmaz wrote:
<blockquote
cite="mid:CAL-68nNk=1NhKxYvHoYKt15xiQVRAknKpHciT94QjEHww_HLpA@mail.gmail.com"
type="cite">Yes<br>
<br>
<div class="gmail_quote">On Wed, Oct 10, 2012 at 3:24 PM, Jakub
Hrozek <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb">
<div class="h5">On Wed, Oct 10, 2012 at 02:42:03PM +0300,
Aziz Sasmaz wrote:<br>
> On Wed, Oct 10, 2012 at 11:37 AM, Jakub Hrozek <<a
moz-do-not-send="true" href="mailto:jhrozek@redhat.com">jhrozek@redhat.com</a>>
wrote:<br>
><br>
> > On Wed, Oct 10, 2012 at 10:34:46AM +0300, Aziz
Sasmaz wrote:<br>
> > > Hi,<br>
> > ><br>
> > > I use sssd on all servers in our
infrastruceture. Most of them Redhat,<br>
> > > Centos and debian. It works very well with
these OSes.<br>
> > > And we have some gentoo linux machines. I
had some difficulties<br>
> > > configuring sssd when I want to use ldaps<br>
> > ><br>
> > > [domain/LDAP]<br>
> > > id_provider = ldap<br>
> > > auth_provider = ldap<br>
> > > chpass_provider = ldap<br>
> > > ldap_schema = rfc2307<br>
> > > ldap_uri = <a class="moz-txt-link-freetext" href="ldaps://">ldaps://</a><a
moz-do-not-send="true" href="http://ldap.xxx.com"
target="_blank">ldap.xxx.com</a><br>
> > > ldap_chpass_uri = <a class="moz-txt-link-freetext" href="ldaps://">ldaps://</a><a
moz-do-not-send="true"
href="http://ldap-provider.xxx.com" target="_blank">ldap-provider.xxx.com</a><br>
> > > ldap_search_base = dc=xxx,dc=com<br>
> > > ldap_tls_reqcert = allow<br>
> > > cache_credentials = true<br>
> > > enumerate = true<br>
> > > entry_cache_timeout = 5400<br>
> > > ldap_user_gecos = uid<br>
> > ><br>
> > > When I use ldap_uri = ldap or ldap_uri =
ldaps getent works, but<br>
> > logins<br>
> > > are not working. There are interesting
entries in log files;<br>
> > ><br>
> > > sssd_LDAP<br>
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
[fo_new_service] (0x0080):<br>
> > > Creating new service 'LDAP'<br>
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
[fo_add_server] (0x0080):<br>
> > > Adding new server '<a
moz-do-not-send="true" href="http://ldap.xxx.com"
target="_blank">ldap.xxx.com</a>', to service 'LDAP'<br>
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
[fo_new_service] (0x0080):<br>
> > > Creating new service 'LDAP_CHPASS'<br>
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
[fo_add_server] (0x0080):<br>
> > > Adding new server '<a
moz-do-not-send="true"
href="http://ldap-provider.xxx.com" target="_blank">ldap-provider.xxx.com</a>',
to service 'LDAP_CHPASS'<br>
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
[sssm_ldap_sudo_init]<br>
> > (0x0080):<br>
> > > Sudo init handler called but SSSD is built
without sudo support, ignoring<br>
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
[sssm_ldap_autofs_init]<br>
> > > (0x0080): Autofs init handler called but
SSSD is built without autofs<br>
> > > support, ignoring<br>
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
[be_process_init] (0x0020):<br>
> > No<br>
> > > Session module provided for [LDAP] !!<br>
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
[be_process_init] (0x0020):<br>
> > No<br>
> > > host info module provided for [LDAP] !!<br>
> > > (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
[main] (0x0020): Backend<br>
> > > provider (LDAP) started!<br>
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
[sdap_sys_connect_done]<br>
> > > (0x0080): Failed to set LDAP SASL nocanon
option to true. If your system<br>
> > is<br>
> > > configured to use SASL, LDAP operations
might fail.<br>
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
[simple_bind_done] (0x0080):<br>
> > > Bind result: Success(0), no errmsg set<br>
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
[sdap_process_group_send]<br>
> > > (0x0040): No Members. Done!<br>
> > > (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
[sdap_process_group_send]<br>
> > > (0x0040): No Members. Done!<br>
> > ><br>
> > > sssd_nss<br>
> > > (Wed Oct 10 09:58:24 2012) [sssd[nss]]
[nss_dp_reconnect_init] (0x0010):<br>
> > > Could not reconnect to LDAP provider.<br>
> > > (Wed Oct 10 09:58:54 2012) [sssd[nss]]
[sbus_reconnect] (0x0080): Making<br>
> > > reconnection attempt 8 to<br>
> > >
[unix:path=/var/lib/sss/pipes/private/sbus-dp_LDAP]<br>
> > > (Wed Oct 10 09:58:54 2012) [sssd[nss]]
[sbus_reconnect] (0x0020): Failed<br>
> > to<br>
> > > open connection:
name=org.freedesktop.DBus.Error.NoServer, message=Failed<br>
> > > to connect to socket
/var/lib/sss/pipes/private/sbus-dp_LDAP: Connection<br>
> > > refused<br>
> > ><br>
> > > sssd_pam<br>
> > > (Wed Oct 10 09:59:24 2012) [sssd[pam]]
[pam_dp_reconnect_init] (0x0010):<br>
> > > Could not reconnect to LDAP provider.<br>
> > > (Wed Oct 10 09:59:54 2012) [sssd[pam]]
[sbus_reconnect] (0x0080): Making<br>
> > > reconnection attempt 10 to<br>
> > >
[unix:path=/var/lib/sss/pipes/private/sbus-dp_LDAP]<br>
> > > (Wed Oct 10 09:59:54 2012) [sssd[pam]]
[sbus_reconnect] (0x0020): Failed<br>
> > to<br>
> > > open connection:
name=org.freedesktop.DBus.Error.NoServer, message=Failed<br>
> > > to connect to socket
/var/lib/sss/pipes/private/sbus-dp_LDAP: Connection<br>
> > > refused<br>
> > ><br>
> > > It says connection refused but there is no
network issue with ldap<br>
> > > servers, all ports opened. Could you
pleasegive me advice resolving this<br>
> > > issue?<br>
> > ><br>
> > > Thanks,<br>
> > ><br>
> > > AS<br>
> ><br>
> > Hi,<br>
> ><br>
> > the Connection Refused message does not describe
a connection to the<br>
> > server but rather connection via unix sockets
between different parts of<br>
> > the SSSD. Can you check the following for me?<br>
> ><br>
> > 1) ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP<br>
> > It should be a symlink pointing to<br>
> > /var/lib/sss/pipes/private/sbus-dp_LDAP.$PID
where $PID should<br>
> > correspond to the PID number of the sssd_be
process.<br>
> ><br>
> > 2) Does restart of the SSSD clear things up?<br>
> ><br>
> > 3) If not, can you paste or attache the DEBUG
messages that the SSSD<br>
> > prints after startup?<br>
> > _______________________________________________<br>
> > sssd-devel mailing list<br>
> > <a moz-do-not-send="true"
href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
> > <a moz-do-not-send="true"
href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel"
target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
> ><br>
><br>
><br>
> Yes there is symbolic link for that.<br>
><br>
> root@admin01 ~# ls -l
/var/lib/sss/pipes/private/sbus-dp_LDAP<br>
> lrwxrwxrwx 1 root root 45 2012-10-10 10:29<br>
> /var/lib/sss/pipes/private/sbus-dp_LDAP -><br>
> /var/lib/sss/pipes/private/sbus-dp_LDAP.31432<br>
><br>
<br>
</div>
</div>
is 31432 a PID of your sssd_be process? If you issue:<br>
ps -axu | grep sssd_be<br>
there should be a sssd_be process running with parameter
--domain LDAP.<br>
<br>
Is there anything interesting in /var/log/sssd_LDAP.log ?<br>
<div class="HOEnZb">
<div class="h5">_______________________________________________<br>
sssd-devel mailing list<br>
<a moz-do-not-send="true"
href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
<a moz-do-not-send="true"
href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel"
target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
</div>
</div>
</blockquote>
</div>
<br>
<div>Hi,</div>
<div><br>
</div>
<div>Yes it'is the same number as pid. As you can see;</div>
<div><br>
</div>
<div>
<div>root@admin01 ~# ls -l
/var/lib/sss/pipes/private/sbus-dp_LDAP</div>
<div>lrwxrwxrwx 1 root root 45 2012-10-10 14:54
/var/lib/sss/pipes/private/sbus-dp_LDAP ->
/var/lib/sss/pipes/private/sbus-dp_LDAP.32375</div>
<div><br>
</div>
<div>root@admin01 ~# ps -fe |grep sssd_be</div>
<div>root 32375 32374 0 14:54 ? 00:00:05
/usr/libexec/sssd/sssd_be --domain LDAP -d 0x00f0
--debug-to-files</div>
<div><br>
</div>
</div>
<div>sssd_LDAP.log is below;</div>
<div><br>
</div>
<div>
<div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
[fo_new_service] (0x0080): Creating new service 'LDAP'</div>
<div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_add_server]
(0x0080): Adding new server '<a moz-do-not-send="true"
href="http://ldap.bilyoner.com">ldap.bilyoner.com</a>', to
service 'LDAP'</div>
<div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
[fo_new_service] (0x0080): Creating new service 'LDAP_CHPASS'</div>
<div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_add_server]
(0x0080): Adding new server '<a moz-do-not-send="true"
href="http://ldap-provider.bilyoner.com">ldap-provider.bilyoner.com</a>',
to service 'LDAP_CHPASS'</div>
<div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
[sssm_ldap_sudo_init] (0x0080): Sudo init handler called but
SSSD is built without sudo support, ignoring</div>
<div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
[sssm_ldap_autofs_init] (0x0080): Autofs init handler called
but SSSD is built without autofs support, ignoring</div>
<div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
[be_process_init] (0x0020): No Session module provided for
[LDAP] !!</div>
<div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
[be_process_init] (0x0020): No host info module provided for
[LDAP] !!</div>
<div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [main]
(0x0020): Backend provider (LDAP) started!</div>
<div>(Wed Oct 10 14:53:45 2012) [sssd[be[LDAP]]]
[sdap_sys_connect_done] (0x0080): Failed to set LDAP SASL
nocanon option to true. If your system is configured to use
SASL, LDAP operations might fail.</div>
</div>
<div><br>
</div>
</blockquote>
<br>
Can it be that underlying ldap library does not support SASL bind or
the option that we are trying to set?<br>
<br>
<br>
<blockquote
cite="mid:CAL-68nNk=1NhKxYvHoYKt15xiQVRAknKpHciT94QjEHww_HLpA@mail.gmail.com"
type="cite">
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
sssd-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>