[SSSD-users] SSSD (1.11.6 with LDAP/Krb5 providers) Init group lookup failed.

杉山昌治 sugishoji at gmail.com
Fri Aug 8 04:35:27 UTC 2014


Hello

I also have a group issue on sssd 1.11.6 with LDAP/Krb5 provider.
When I used sssd-1.9.2-129.el6_5.4.x86_64, I could get all belonging
groups by "id" command.
After I updated to sssd-1.11.6-1, I could get only primary group by
"id" command.
I needed to retrieve each group information by "getent group" command,
After that I could get all belonging groups by "id" command.
It looks like the initial group lookup failed on sssd-1.11.6-1.
Is this behavior a bug or spec of version 1.11.6 or I missed something
in configuration file ?
I would appreciate your kind support.

Reproduce Procedures
================
1. Set up desired sssd version
2. Remove cache files
    # rm -f /var/lib/sss/db/cache*
3. Start sssd
    # sssd -i -d7 -c sssd.conf-LDAP
4. Check account information by "id" command
    # id shoji-lab
5. Check group information by "getent group" command
    # getent group G-Role-ISOps-Server
6. Check account information again.
    # id shoji-lab


Test Result (sssd-1.9.2-129)
====================
[admin at jpbl0-in00-is16 ~]$ rpm -q sssd
sssd-1.9.2-129.el6_5.4.x86_64
[admin at jpbl0-in00-is16 ~]$ id shoji-lab
uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain
Users),20166(U-Role-ISOps-Server),20165(G-Role-ISOps-Server)
[admin at jpbl0-in00-is16 ~]$ getent group G-Role-ISOps-Server
G-Role-ISOps-Server:*:20165:shoji-lab,bmulvany-lab,banban-lab,test_shoji,mokbrian-lab,arionk-lab,bleej-lab,haughtoj-lab,tstevens-lab,dkeane-lab,danoneil-lab,srpenn-lab
[admin at jpbl0-in00-is16 ~]$ id shoji-lab
uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain
Users),20166(U-Role-ISOps-Server),20165(G-Role-ISOps-Server)


Test Result (sssd-1.11.6-1)
====================
[admin at jpbl0-in00-is16 ~]$ id shoji-lab
uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain Users)
[admin at jpbl0-in00-is16 ~]$ getent group G-Role-ISOps-Server
G-Role-ISOps-Server:*:20165:shoji-lab,bmulvany-lab,banban-lab,test_shoji,mokbrian-lab,arionk-lab,bleej-lab,haughtoj-lab,tstevens-lab,dkeane-lab,danoneil-lab,srpenn-lab
[admin at jpbl0-in00-is16 ~]$ id shoji-lab
uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain
Users),20165(G-Role-ISOps-Server)

Error Log Summary (sssd-1.11.6-1)
==========================
(Fri Aug  8 03:30:18 2014) [sssd[nss]] [nss_memcache_initgr_check]
(0x1000): Got request for [shoji-lab at labsso]
(Fri Aug  8 03:30:18 2014) [sssd[nss]] [sss_dp_get_reply] (0x1000):
Got reply from Data Provider - DP error code: 3 errno: 22 error
message: Init group lookup failed
(Fri Aug  8 03:30:18 2014) [sssd[nss]] [nss_cmd_getby_dp_callback]
(0x0040): Unable to get information from Data Provider
Error: 3, 22, Init group lookup failed
Will try to return what we have in cache
(Fri Aug  8 03:30:18 2014) [sssd[nss]] [sss_dp_req_destructor]
(0x0400): Deleting request: [0x418450:3:shoji-lab at labsso]
(Fri Aug  8 03:30:18 2014) [sssd[be[labsso]]] [acctinfo_callback]
(0x0100): Request processed. Returned 3,22,Init group lookup failed
(Fri Aug  8 03:30:18 2014) [sssd[nss]] [client_recv] (0x0200): Client
disconnected!



SSSD Configuration : Using LDAP/Krb5 providers
====================================
[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = labsso

[nss]

[pam]

[sudo]

[domain/labsso]
enumerate = false
ldap_id_use_start_tls = False
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5

krb5_realm = LABSSO.LABROOT.ISOPS.EXAMPLE.COM
krb5_server = jpbw0-in00-is82.labsso.labroot.isops.example.com
krb5_kpasswd = jpbw0-in00-is82.labsso.labroot.isops.example.com

ldap_schema = rfc2307bis
ldap_force_upper_case_realm = True
ldap_user_object_class = person
ldap_group_object_class = group
ldap_user_gecos = displayName
ldap_user_home_directory = unixHomeDirectory
ldap_uri = ldap://jpbw0-in00-is82.labsso.labroot.isops.example.com
ldap_search_base = DC=labsso,DC=labroot,DC=isops,DC=example,DC=com
ldap_default_bind_dn = bindisops-lab at labsso.labroot.isops.example.com
ldap_default_authtok_type = password
ldap_default_authtok = password
ldap_referrals = False


LDAP Server (Active Directory) User/Group Hierarchy
========================================
shoji-lab (uid=20000, @LABSSO)
G-Role-ISOps-Server (gid=20165, @LABSSO)
U-Role-ISOps-Server (gid=20166, @LABSSO)

Regards,
Shoji Sugiyama


More information about the sssd-users mailing list