<div dir="ltr"><div><div>The sssd .conf is in attached in my first message in this thread.<br><br></div>I will try to upgrade sssd to the version from RH 6.4 and see how it works.<br><br></div>Mathieu<br></div><div class="gmail_extra">
<br><br><div class="gmail_quote">2013/7/8 Stephen Gallagher <span dir="ltr"><<a href="mailto:sgallagh@redhat.com" target="_blank">sgallagh@redhat.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<div><div class="h5"><br>
On 07/08/2013 02:49 AM, Jakub Hrozek wrote:<br>
> On Fri, Jul 05, 2013 at 03:54:57PM +0200, Mathieu Bouillaguet<br>
> wrote:<br>
>> Hello,<br>
>><br>
>> We are trying to get sssd to resolv netgroups. Our goal is to be<br>
>> able to specify group of hosts in sudo rules. The sudo<br>
>> configuration is held in the Active Directory DC. The only way to<br>
>> do that in our environment seems to be by using host netgroups.<br>
>><br>
>> We use Red Hat 6.2, the sssd version is 1.5.1.-66.el6.<br>
><br>
> Hi Mathieu,<br>
><br>
> this is quite an old version, I think you should really upgrade.<br>
><br>
>><br>
>> We have a working configuration with auth_provider=krb5,<br>
>> id_provider=ldap and access_provider=ldap.<br>
>><br>
>> In nsswitch.conf passwd, group and shadow have "files sss" and<br>
>> getent return the expected information.<br>
>><br>
>> For netgroup, I have also put "files sss" but I cannot resolv any<br>
>> netgroup.<br>
>><br>
>> When I type : getent netgroup -s sss <NetGroup> I see the<br>
>> following logs in sssd_nss.log :<br>
>><br>
>> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [sbus_dispatch] (9): dbus<br>
>> conn: 6560B0 (Fri Jul 5 15:48:04 2013) [sssd[nss]]<br>
>> [sbus_dispatch] (9): Dispatching. (Fri Jul 5 15:48:04 2013)<br>
>> [sssd[nss]] [sbus_message_handler] (9): Received SBUS method<br>
>> [ping] (Fri Jul 5 15:48:04 2013) [sssd[nss]] [get_client_cred]<br>
>> (9): Client creds: euid[0] egid[0] pid[18938]. (Fri Jul 5<br>
>> 15:48:04 2013) [sssd[nss]] [accept_fd_handler] (4): Client<br>
>> connected! (Fri Jul 5 15:48:04 2013) [sssd[nss]]<br>
>> [sss_cmd_get_version] (5): Received client version [1]. (Fri Jul<br>
>> 5 15:48:04 2013) [sssd[nss]] [sss_cmd_get_version] (5): Offered<br>
>> version [1]. (Fri Jul 5 15:48:04 2013) [sssd[nss]]<br>
>> [setnetgrent_send] (4): Requesting info for netgroup<br>
>> [Linux.Global] from [<ALL>] (Fri Jul 5 15:48:04 2013)<br>
>> [sssd[nss]] [sss_ncache_check_str] (8): Checking negative cache<br>
>> for [NCE/NETGR/LOCAL/Linux.Global] (Fri Jul 5 15:48:04 2013)<br>
>> [sssd[nss]] [lookup_netgr_step] (4): Requesting info for<br>
>> [Linux.Global@LOCAL] (Fri Jul 5 15:48:04 2013) [sssd[nss]] [ldb]<br>
>> (9): tevent: Added timed event "ltdb_callback": 0x65dc80 (Fri Jul<br>
>> 5 15:48:04 2013) [sssd[nss]] [ldb] (9): tevent: Added timed<br>
>> event "ltdb_timeout": 0x652170 (Fri Jul 5 15:48:04 2013)<br>
>> [sssd[nss]] [ldb] (9): tevent: Destroying timer event 0x652170<br>
>> "ltdb_timeout" (Fri Jul 5 15:48:04 2013) [sssd[nss]] [ldb] (9):<br>
>> tevent: Ending timer event 0x65dc80 "ltdb_callback" (Fri Jul 5<br>
>> 15:48:04 2013) [sssd[nss]] [lookup_netgr_step] (2): No matching<br>
>> domain found for [Linux.Global], fail! (Fri Jul 5 15:48:04 2013)<br>
>> [sssd[nss]] [nss_cmd_setnetgrent] (0): Fatal error calling<br>
>> setnetgrent_send (Fri Jul 5 15:48:04 2013) [sssd[nss]]<br>
>> [client_recv] (5): Client disconnected! (Fri Jul 5 15:48:04<br>
>> 2013) [sssd[nss]] [get_client_cred] (9): Client creds: euid[0]<br>
>> egid[0] pid[18938]. (Fri Jul 5 15:48:04 2013) [sssd[nss]]<br>
>> [accept_fd_handler] (4): Client connected! (Fri Jul 5 15:48:04<br>
>> 2013) [sssd[nss]] [sss_cmd_get_version] (5): Received client<br>
>> version [1]. (Fri Jul 5 15:48:04 2013) [sssd[nss]]<br>
>> [sss_cmd_get_version] (5): Offered version [1]. (Fri Jul 5<br>
>> 15:48:04 2013) [sssd[nss]] [client_recv] (5): Client<br>
>> disconnected! (Fri Jul 5 15:48:14 2013) [sssd[nss]]<br>
>> [sbus_dispatch] (9): dbus conn: 6560B0 (Fri Jul 5 15:48:14 2013)<br>
>> [sssd[nss]] [sbus_dispatch] (9): Dispatching. (Fri Jul 5<br>
>> 15:48:14 2013) [sssd[nss]] [sbus_message_handler] (9): Received<br>
>> SBUS method [ping] (Fri Jul 5 15:48:24 2013) [sssd[nss]]<br>
>> [sbus_dispatch] (9): dbus conn: 6560B0 (Fri Jul 5 15:48:24 2013)<br>
>> [sssd[nss]] [sbus_dispatch] (9): Dispatching. (Fri Jul 5<br>
>> 15:48:24 2013) [sssd[nss]] [sbus_message_handler] (9): Received<br>
>> SBUS method [ping]<br>
>><br>
>> Notably, I can see that it appears as if sssd cannot find the<br>
>> right domain to query netgroups.<br>
>><br>
><br>
> The error message actually means that the SSSD tried to search the<br>
> configured domain and didn't find the netgroup. But the logs you<br>
> paste are only from the nss process which doesn't actually perform<br>
> the searches.<br>
><br>
> Can you put debug_level=10 into the [domain] section in sssd.conf,<br>
> restart the SSSD and check the /var/log/sssd/sssd_$domain.log ?<br>
<br>
<br>
</div></div>Actually, reading more closely, it tries to check the domain labeled<br>
"LOCAL" and then fails in the NSS responder trying to call<br>
setnetgrent_send(). Looking at the code for that version, it means<br>
that the tevent_req returned NULL here, so it never got sent to the<br>
data provider at all.<br>
<br>
It looks like there was probably a bug with handling multiple domains<br>
there (not sure if it still exists; I don't know if anyone ever tested<br>
this).<br>
<br>
Mathieu, would you mind sharing your (sanitized) sssd.conf with us?<br>
Also, if you could please try upgrading to the RHEL 6.4 version of<br>
SSSD on one of your machines to verify whether the bug has been fixed<br>
there already, that would be very helpful. You *should* be able to<br>
install the 6.4 SSSD on 6.2 just fine (though you will also need to<br>
update libtdb, libtevent, libtalloc, libldb, selinux-policy, krb5-libs<br>
and possibly openldap-libs as well).<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.13 (GNU/Linux)<br>
Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br>
<br>
iEYEARECAAYFAlHarGYACgkQeiVVYja6o6NEIQCfWpvD2hF4va7ak6f01ziDKdpp<br>
zEsAni5yFxzy4FKSmiXL3vzWyyQOm75H<br>
=AVdC<br>
-----END PGP SIGNATURE-----<br>
<div class="HOEnZb"><div class="h5">_______________________________________________<br>
sssd-devel mailing list<br>
<a href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
</div></div></blockquote></div><br></div>