<div dir="ltr"><div><div><div>Hi, thanks for your reply.<br><br></div>Unfortunately, we can't upgrade the red hat version now. This decision would involve hundreds of virtual machines which run production applications. Hence it would require a long and costly impact study before upgrading.<br>
<br></div>I attached the sssd_AOP.log in its state after a "service sssd start" and I typed "getent netgroup -s sss Linux.Global".<br><br></div>Regards<br>Mathieu<br></div><div class="gmail_extra"><br>
<br><div class="gmail_quote">2013/7/8 Jakub Hrozek <span dir="ltr"><<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On Fri, Jul 05, 2013 at 03:54:57PM +0200, Mathieu Bouillaguet wrote:<br>
> Hello,<br>
><br>
> We are trying to get sssd to resolv netgroups. Our goal is to be able to<br>
> specify group of hosts in sudo rules. The sudo configuration is held in the<br>
> Active Directory DC. The only way to do that in our environment seems to be<br>
> by using host netgroups.<br>
><br>
> We use Red Hat 6.2, the sssd version is 1.5.1.-66.el6.<br>
<br>
</div>Hi Mathieu,<br>
<br>
this is quite an old version, I think you should really upgrade.<br>
<div><div class="h5"><br>
><br>
> We have a working configuration with auth_provider=krb5, id_provider=ldap<br>
> and access_provider=ldap.<br>
><br>
> In nsswitch.conf passwd, group and shadow have "files sss" and getent<br>
> return the expected information.<br>
><br>
> For netgroup, I have also put "files sss" but I cannot resolv any netgroup.<br>
><br>
> When I type : getent netgroup -s sss <NetGroup><br>
> I see the following logs in sssd_nss.log :<br>
><br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [sbus_dispatch] (9): dbus conn:<br>
> 6560B0<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [sbus_dispatch] (9): Dispatching.<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [sbus_message_handler] (9): Received<br>
> SBUS method [ping]<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [get_client_cred] (9): Client creds:<br>
> euid[0] egid[0] pid[18938].<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [accept_fd_handler] (4): Client<br>
> connected!<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [sss_cmd_get_version] (5): Received<br>
> client version [1].<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [sss_cmd_get_version] (5): Offered<br>
> version [1].<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [setnetgrent_send] (4): Requesting<br>
> info for netgroup [Linux.Global] from [<ALL>]<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [sss_ncache_check_str] (8): Checking<br>
> negative cache for [NCE/NETGR/LOCAL/Linux.Global]<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [lookup_netgr_step] (4): Requesting<br>
> info for [Linux.Global@LOCAL]<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [ldb] (9): tevent: Added timed event<br>
> "ltdb_callback": 0x65dc80<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [ldb] (9): tevent: Added timed event<br>
> "ltdb_timeout": 0x652170<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [ldb] (9): tevent: Destroying timer<br>
> event 0x652170 "ltdb_timeout"<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [ldb] (9): tevent: Ending timer<br>
> event 0x65dc80 "ltdb_callback"<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [lookup_netgr_step] (2): No matching<br>
> domain found for [Linux.Global], fail!<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [nss_cmd_setnetgrent] (0): Fatal<br>
> error calling setnetgrent_send<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [client_recv] (5): Client<br>
> disconnected!<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [get_client_cred] (9): Client creds:<br>
> euid[0] egid[0] pid[18938].<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [accept_fd_handler] (4): Client<br>
> connected!<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [sss_cmd_get_version] (5): Received<br>
> client version [1].<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [sss_cmd_get_version] (5): Offered<br>
> version [1].<br>
> (Fri Jul 5 15:48:04 2013) [sssd[nss]] [client_recv] (5): Client<br>
> disconnected!<br>
> (Fri Jul 5 15:48:14 2013) [sssd[nss]] [sbus_dispatch] (9): dbus conn:<br>
> 6560B0<br>
> (Fri Jul 5 15:48:14 2013) [sssd[nss]] [sbus_dispatch] (9): Dispatching.<br>
> (Fri Jul 5 15:48:14 2013) [sssd[nss]] [sbus_message_handler] (9): Received<br>
> SBUS method [ping]<br>
> (Fri Jul 5 15:48:24 2013) [sssd[nss]] [sbus_dispatch] (9): dbus conn:<br>
> 6560B0<br>
> (Fri Jul 5 15:48:24 2013) [sssd[nss]] [sbus_dispatch] (9): Dispatching.<br>
> (Fri Jul 5 15:48:24 2013) [sssd[nss]] [sbus_message_handler] (9): Received<br>
> SBUS method [ping]<br>
><br>
> Notably, I can see that it appears as if sssd cannot find the right domain<br>
> to query netgroups.<br>
><br>
<br>
</div></div>The error message actually means that the SSSD tried to search the<br>
configured domain and didn't find the netgroup. But the logs you paste<br>
are only from the nss process which doesn't actually perform the<br>
searches.<br>
<br>
Can you put debug_level=10 into the [domain] section in sssd.conf, restart<br>
the SSSD and check the /var/log/sssd/sssd_$domain.log ?<br>
_______________________________________________<br>
sssd-devel mailing list<br>
<a href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
</blockquote></div><br></div>