<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    On 10/10/2012 10:48 AM, Aziz Sasmaz wrote:
    <blockquote
cite="mid:CAL-68nNk=1NhKxYvHoYKt15xiQVRAknKpHciT94QjEHww_HLpA@mail.gmail.com"
      type="cite">Yes<br>
      <br>
      <div class="gmail_quote">On Wed, Oct 10, 2012 at 3:24 PM, Jakub
        Hrozek <span dir="ltr">&lt;<a moz-do-not-send="true"
            href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>&gt;</span>
        wrote:<br>
        <blockquote class="gmail_quote" style="margin:0 0 0
          .8ex;border-left:1px #ccc solid;padding-left:1ex">
          <div class="HOEnZb">
            <div class="h5">On Wed, Oct 10, 2012 at 02:42:03PM +0300,
              Aziz Sasmaz wrote:<br>
              &gt; On Wed, Oct 10, 2012 at 11:37 AM, Jakub Hrozek &lt;<a
                moz-do-not-send="true" href="mailto:jhrozek@redhat.com">jhrozek@redhat.com</a>&gt;
              wrote:<br>
              &gt;<br>
              &gt; &gt; On Wed, Oct 10, 2012 at 10:34:46AM +0300, Aziz
              Sasmaz wrote:<br>
              &gt; &gt; &gt; Hi,<br>
              &gt; &gt; &gt;<br>
              &gt; &gt; &gt; I use sssd on all servers in our
              infrastruceture.  Most of them Redhat,<br>
              &gt; &gt; &gt; Centos and debian. It works very well with
              these OSes.<br>
              &gt; &gt; &gt;  And we have some gentoo linux machines.  I
              had  some difficulties<br>
              &gt; &gt; &gt; configuring sssd when I want to use ldaps<br>
              &gt; &gt; &gt;<br>
              &gt; &gt; &gt; [domain/LDAP]<br>
              &gt; &gt; &gt; id_provider = ldap<br>
              &gt; &gt; &gt; auth_provider = ldap<br>
              &gt; &gt; &gt; chpass_provider = ldap<br>
              &gt; &gt; &gt; ldap_schema = rfc2307<br>
              &gt; &gt; &gt; ldap_uri = <a class="moz-txt-link-freetext" href="ldaps://">ldaps://</a><a
                moz-do-not-send="true" href="http://ldap.xxx.com"
                target="_blank">ldap.xxx.com</a><br>
              &gt; &gt; &gt; ldap_chpass_uri = <a class="moz-txt-link-freetext" href="ldaps://">ldaps://</a><a
                moz-do-not-send="true"
                href="http://ldap-provider.xxx.com" target="_blank">ldap-provider.xxx.com</a><br>
              &gt; &gt; &gt; ldap_search_base = dc=xxx,dc=com<br>
              &gt; &gt; &gt; ldap_tls_reqcert = allow<br>
              &gt; &gt; &gt; cache_credentials = true<br>
              &gt; &gt; &gt; enumerate = true<br>
              &gt; &gt; &gt; entry_cache_timeout = 5400<br>
              &gt; &gt; &gt; ldap_user_gecos = uid<br>
              &gt; &gt; &gt;<br>
              &gt; &gt; &gt; When I use ldap_uri = ldap   or  ldap_uri =
              ldaps  getent works, but<br>
              &gt; &gt; logins<br>
              &gt; &gt; &gt; are not working. There are interesting
              entries in log files;<br>
              &gt; &gt; &gt;<br>
              &gt; &gt; &gt; sssd_LDAP<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
              [fo_new_service] (0x0080):<br>
              &gt; &gt; &gt; Creating new service 'LDAP'<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
              [fo_add_server] (0x0080):<br>
              &gt; &gt; &gt; Adding new server '<a
                moz-do-not-send="true" href="http://ldap.xxx.com"
                target="_blank">ldap.xxx.com</a>', to service 'LDAP'<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
              [fo_new_service] (0x0080):<br>
              &gt; &gt; &gt; Creating new service 'LDAP_CHPASS'<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
              [fo_add_server] (0x0080):<br>
              &gt; &gt; &gt; Adding new server '<a
                moz-do-not-send="true"
                href="http://ldap-provider.xxx.com" target="_blank">ldap-provider.xxx.com</a>',
              to service 'LDAP_CHPASS'<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
              [sssm_ldap_sudo_init]<br>
              &gt; &gt; (0x0080):<br>
              &gt; &gt; &gt; Sudo init handler called but SSSD is built
              without sudo support, ignoring<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
              [sssm_ldap_autofs_init]<br>
              &gt; &gt; &gt; (0x0080): Autofs init handler called but
              SSSD is built without autofs<br>
              &gt; &gt; &gt; support, ignoring<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
              [be_process_init] (0x0020):<br>
              &gt; &gt; No<br>
              &gt; &gt; &gt; Session module provided for [LDAP] !!<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
              [be_process_init] (0x0020):<br>
              &gt; &gt; No<br>
              &gt; &gt; &gt; host info module provided for [LDAP] !!<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:33 2012) [sssd[be[LDAP]]]
              [main] (0x0020): Backend<br>
              &gt; &gt; &gt; provider (LDAP) started!<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
              [sdap_sys_connect_done]<br>
              &gt; &gt; &gt; (0x0080): Failed to set LDAP SASL nocanon
              option to true. If your system<br>
              &gt; &gt; is<br>
              &gt; &gt; &gt; configured to use SASL, LDAP operations
              might fail.<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
              [simple_bind_done] (0x0080):<br>
              &gt; &gt; &gt; Bind result: Success(0), no errmsg set<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
              [sdap_process_group_send]<br>
              &gt; &gt; &gt; (0x0040): No Members. Done!<br>
              &gt; &gt; &gt; (Wed Oct 10 10:19:43 2012) [sssd[be[LDAP]]]
              [sdap_process_group_send]<br>
              &gt; &gt; &gt; (0x0040): No Members. Done!<br>
              &gt; &gt; &gt;<br>
              &gt; &gt; &gt; sssd_nss<br>
              &gt; &gt; &gt; (Wed Oct 10 09:58:24 2012) [sssd[nss]]
              [nss_dp_reconnect_init] (0x0010):<br>
              &gt; &gt; &gt; Could not reconnect to LDAP provider.<br>
              &gt; &gt; &gt; (Wed Oct 10 09:58:54 2012) [sssd[nss]]
              [sbus_reconnect] (0x0080): Making<br>
              &gt; &gt; &gt; reconnection attempt 8 to<br>
              &gt; &gt; &gt;
              [unix:path=/var/lib/sss/pipes/private/sbus-dp_LDAP]<br>
              &gt; &gt; &gt; (Wed Oct 10 09:58:54 2012) [sssd[nss]]
              [sbus_reconnect] (0x0020): Failed<br>
              &gt; &gt; to<br>
              &gt; &gt; &gt; open connection:
              name=org.freedesktop.DBus.Error.NoServer, message=Failed<br>
              &gt; &gt; &gt; to connect to socket
              /var/lib/sss/pipes/private/sbus-dp_LDAP: Connection<br>
              &gt; &gt; &gt; refused<br>
              &gt; &gt; &gt;<br>
              &gt; &gt; &gt; sssd_pam<br>
              &gt; &gt; &gt; (Wed Oct 10 09:59:24 2012) [sssd[pam]]
              [pam_dp_reconnect_init] (0x0010):<br>
              &gt; &gt; &gt; Could not reconnect to LDAP provider.<br>
              &gt; &gt; &gt; (Wed Oct 10 09:59:54 2012) [sssd[pam]]
              [sbus_reconnect] (0x0080): Making<br>
              &gt; &gt; &gt; reconnection attempt 10 to<br>
              &gt; &gt; &gt;
              [unix:path=/var/lib/sss/pipes/private/sbus-dp_LDAP]<br>
              &gt; &gt; &gt; (Wed Oct 10 09:59:54 2012) [sssd[pam]]
              [sbus_reconnect] (0x0020): Failed<br>
              &gt; &gt; to<br>
              &gt; &gt; &gt; open connection:
              name=org.freedesktop.DBus.Error.NoServer, message=Failed<br>
              &gt; &gt; &gt; to connect to socket
              /var/lib/sss/pipes/private/sbus-dp_LDAP: Connection<br>
              &gt; &gt; &gt; refused<br>
              &gt; &gt; &gt;<br>
              &gt; &gt; &gt; It says  connection refused but there is no
              network issue with ldap<br>
              &gt; &gt; &gt; servers, all ports opened. Could you
              pleasegive me advice resolving this<br>
              &gt; &gt; &gt; issue?<br>
              &gt; &gt; &gt;<br>
              &gt; &gt; &gt; Thanks,<br>
              &gt; &gt; &gt;<br>
              &gt; &gt; &gt; AS<br>
              &gt; &gt;<br>
              &gt; &gt; Hi,<br>
              &gt; &gt;<br>
              &gt; &gt; the Connection Refused message does not describe
              a connection to the<br>
              &gt; &gt; server but rather connection via unix sockets
              between different parts of<br>
              &gt; &gt; the SSSD. Can you check the following for me?<br>
              &gt; &gt;<br>
              &gt; &gt; 1) ls -l /var/lib/sss/pipes/private/sbus-dp_LDAP<br>
              &gt; &gt; It should be a symlink pointing to<br>
              &gt; &gt; /var/lib/sss/pipes/private/sbus-dp_LDAP.$PID
              where $PID should<br>
              &gt; &gt; correspond to the PID number of the sssd_be
              process.<br>
              &gt; &gt;<br>
              &gt; &gt; 2) Does restart of the SSSD clear things up?<br>
              &gt; &gt;<br>
              &gt; &gt; 3) If not, can you paste or attache the DEBUG
              messages that the SSSD<br>
              &gt; &gt; prints after startup?<br>
              &gt; &gt; _______________________________________________<br>
              &gt; &gt; sssd-devel mailing list<br>
              &gt; &gt; <a moz-do-not-send="true"
                href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
              &gt; &gt; <a moz-do-not-send="true"
                href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel"
                target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
              &gt; &gt;<br>
              &gt;<br>
              &gt;<br>
              &gt; Yes there is symbolic link for that.<br>
              &gt;<br>
              &gt; root@admin01 ~#  ls -l
              /var/lib/sss/pipes/private/sbus-dp_LDAP<br>
              &gt; lrwxrwxrwx 1 root root 45 2012-10-10 10:29<br>
              &gt; /var/lib/sss/pipes/private/sbus-dp_LDAP -&gt;<br>
              &gt; /var/lib/sss/pipes/private/sbus-dp_LDAP.31432<br>
              &gt;<br>
              <br>
            </div>
          </div>
          is 31432 a PID of your sssd_be process? If you issue:<br>
          ps -axu | grep sssd_be<br>
          there should be a sssd_be process running with parameter
          --domain LDAP.<br>
          <br>
          Is there anything interesting in /var/log/sssd_LDAP.log ?<br>
          <div class="HOEnZb">
            <div class="h5">_______________________________________________<br>
              sssd-devel mailing list<br>
              <a moz-do-not-send="true"
                href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
              <a moz-do-not-send="true"
                href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel"
                target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
            </div>
          </div>
        </blockquote>
      </div>
      <br>
      <div>Hi,</div>
      <div><br>
      </div>
      <div>Yes it'is the same number as pid. As you can see;</div>
      <div><br>
      </div>
      <div>
        <div>root@admin01 ~# ls -l
          /var/lib/sss/pipes/private/sbus-dp_LDAP</div>
        <div>lrwxrwxrwx 1 root root 45 2012-10-10 14:54
          /var/lib/sss/pipes/private/sbus-dp_LDAP -&gt;
          /var/lib/sss/pipes/private/sbus-dp_LDAP.32375</div>
        <div><br>
        </div>
        <div>root@admin01 ~# ps -fe |grep sssd_be</div>
        <div>root     32375 32374  0 14:54 ?        00:00:05
          /usr/libexec/sssd/sssd_be --domain LDAP -d 0x00f0
          --debug-to-files</div>
        <div><br>
        </div>
      </div>
      <div>sssd_LDAP.log  is below;</div>
      <div><br>
      </div>
      <div>
        <div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
          [fo_new_service] (0x0080): Creating new service 'LDAP'</div>
        <div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_add_server]
          (0x0080): Adding new server '<a moz-do-not-send="true"
            href="http://ldap.bilyoner.com">ldap.bilyoner.com</a>', to
          service 'LDAP'</div>
        <div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
          [fo_new_service] (0x0080): Creating new service 'LDAP_CHPASS'</div>
        <div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [fo_add_server]
          (0x0080): Adding new server '<a moz-do-not-send="true"
            href="http://ldap-provider.bilyoner.com">ldap-provider.bilyoner.com</a>',
          to service 'LDAP_CHPASS'</div>
        <div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
          [sssm_ldap_sudo_init] (0x0080): Sudo init handler called but
          SSSD is built without sudo support, ignoring</div>
        <div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
          [sssm_ldap_autofs_init] (0x0080): Autofs init handler called
          but SSSD is built without autofs support, ignoring</div>
        <div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
          [be_process_init] (0x0020): No Session module provided for
          [LDAP] !!</div>
        <div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]]
          [be_process_init] (0x0020): No host info module provided for
          [LDAP] !!</div>
        <div>(Wed Oct 10 14:53:35 2012) [sssd[be[LDAP]]] [main]
          (0x0020): Backend provider (LDAP) started!</div>
        <div>(Wed Oct 10 14:53:45 2012) [sssd[be[LDAP]]]
          [sdap_sys_connect_done] (0x0080): Failed to set LDAP SASL
          nocanon option to true. If your system is configured to use
          SASL, LDAP operations might fail.</div>
      </div>
      <div><br>
      </div>
    </blockquote>
    <br>
    Can it be that underlying ldap library does not support SASL bind or
    the option that we are trying to set?<br>
    <br>
    <br>
    <blockquote
cite="mid:CAL-68nNk=1NhKxYvHoYKt15xiQVRAknKpHciT94QjEHww_HLpA@mail.gmail.com"
      type="cite">
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
sssd-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>


</pre>
  </body>
</html>