[SSSD-users] sssd auth issue on centos 5.10

Daniel Jung mimianddaniel at gmail.com
Fri Aug 15 23:10:41 UTC 2014


Was unable to patch those to 1.9.6 (first one was already patched?) Second
one was causing error during compile:

Also,  i see these in the log :
(Fri Aug 15 01:25:04 2014) [sssd[be[LDAP]]] [sdap_get_generic_step] (7):
Requesting attrs: [highestCommittedUSN]
(Fri Aug 15 01:25:04 2014) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
Search result: Success(0), (null)
(Fri Aug 15 01:25:04 2014) [sssd[be[LDAP]]]
[sdap_get_server_opts_from_rootdse] (5): No known USN scheme is supported
by this server!
(Fri Aug 15 01:25:04 2014) [sssd[be[LDAP]]] [simple_bind_send] (4):
Executing simple bind as: (null)
(Fri Aug 15 01:25:04 2014) [sssd[be[LDAP]]] [simple_bind_done] (5): Server
returned no controls.
(Fri Aug 15 01:25:04 2014) [sssd[be[LDAP]]] [simple_bind_done] (3): Bind
result: Success(0), (null)

http://www.openldap.org/its/index.cgi/Incoming?id=6789

based on the previous url, (null) return meaning, there is an issue with
the cert?

Also, i see  slap_global_control: unrecognized control:
1.3.6.1.4.1.42.2.27.8.5.1 in the ldap.log on the ldap server which seems to
indicate that sssd is trying to use password policy? but i dont see this
behaviour on the centos6 1.9.  Is the behaviour different on 1.5.1 from
other ?


if /bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I.
-I.  -Wall -Iinclude -I.. -I./include -I./src/sss_client -I./src -Iinclude
-I.      -I/usr/include/dbus-1.0 -I/usr/lib64/dbus-1.0
/include        -I/usr/include/openldap24 -I/usr/include/glib-2.0
-I/usr/lib64/glib-2.0/include   -DLIBDIR=\"/usr/lib64\" -DVARDIR=\"/var\"
-DSHLIBEXT=\"\" -DSSSD_LIBEXEC_PATH=\"/usr/libexec/sssd\" -DSSSD_INTRO
SPECT_PATH=\"\" -DSSSD_CONF_DIR=\"/etc/sssd\"
-DSSS_NSS_MCACHE_DIR=\"/var/lib/sss/mc\"
-DSSS_NSS_SOCKET_NAME=\"/var/lib/sss/pipes/nss\"
-DSSS_PAM_SOCKET_NAME=\"/var/lib/sss/pipes/pam\" -DSSS_PAC_SOCKET_NAME=\"/
var/lib/sss/pipes/pac\"
-DSSS_PAM_PRIV_SOCKET_NAME=\"/var/lib/sss/pipes/private/pam\"
-DSSS_SUDO_SOCKET_NAME=\"/var/lib/sss/pipes/sudo\"
-DSSS_AUTOFS_SOCKET_NAME=\"/var/lib/sss/pipes/autofs\" -DSSS_SSH_SOCKET_N
AME=\"/var/lib/sss/pipes/ssh\" -DLOCALEDIR=\"@localedir@\"   -Wall -Wshadow
-Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align
-Wwrite-strings -Werror-implicit-function-declaration -fno-strict-aliasin
g -std=gnu99 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
-fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
-D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -MT
src/prov
iders/ldap/sdap_reinit.lo -MD -MP -MF "$depbase.Tpo" -c -o
src/providers/ldap/sdap_reinit.lo src/providers/ldap/sdap_reinit.c; \
        then mv -f "$depbase.Tpo" "$depbase.Plo"; else rm -f
"$depbase.Tpo"; exit 1; fi
 gcc -DHAVE_CONFIG_H -I. -I. -I. -Wall -Iinclude -I.. -I./include
-I./src/sss_client -I./src -Iinclude -I. -I/usr/include/dbus-1.0
-I/usr/lib64/dbus-1.0/include -I/usr/include/openldap24
-I/usr/include/glib-2.0
 -I/usr/lib64/glib-2.0/include -DLIBDIR=\"/usr/lib64\" -DVARDIR=\"/var\"
-DSHLIBEXT=\"\" -DSSSD_LIBEXEC_PATH=\"/usr/libexec/sssd\"
-DSSSD_INTROSPECT_PATH=\"\" -DSSSD_CONF_DIR=\"/etc/sssd\"
-DSSS_NSS_MCACHE_DIR=
\"/var/lib/sss/mc\" -DSSS_NSS_SOCKET_NAME=\"/var/lib/sss/pipes/nss\"
-DSSS_PAM_SOCKET_NAME=\"/var/lib/sss/pipes/pam\"
-DSSS_PAC_SOCKET_NAME=\"/var/lib/sss/pipes/pac\"
-DSSS_PAM_PRIV_SOCKET_NAME=\"/var/lib/sss/p
ipes/private/pam\" -DSSS_SUDO_SOCKET_NAME=\"/var/lib/sss/pipes/sudo\"
-DSSS_AUTOFS_SOCKET_NAME=\"/var/lib/sss/pipes/autofs\"
-DSSS_SSH_SOCKET_NAME=\"/var/lib/sss/pipes/ssh\" -DLOCALEDIR=\"@localedir@\"
-Wall -W
shadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align
-Wwrite-strings -Werror-implicit-function-declaration -fno-strict-aliasing
-std=gnu99 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
-fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
-D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -MT
src/providers/ldap/sdap_async_connection.lo -MD -MP -MF
src/providers/ldap/.d
eps/sdap_async_connection.Tpo -c src/providers/ldap/sdap_async_connection.c
 -fPIC -DPIC -o src/providers/ldap/.libs/sdap_async_connection.o
src/providers/ldap/sdap_async.c:842: error: expected identifier or '('
before 'if'
 gcc -DHAVE_CONFIG_H -I. -I. -I. -Wall -Iinclude -I.. -I./include
-I./src/sss_client -I./src -Iinclude -I. -I/usr/include/dbus-1.0
-I/usr/lib64/dbus-1.0/include -I/usr/include/openldap24
-I/usr/include/glib-2.0
 -I/usr/lib64/glib-2.0/include -DLIBDIR=\"/usr/lib64\" -DVARDIR=\"/var\"
-DSHLIBEXT=\"\" -DSSSD_LIBEXEC_PATH=\"/usr/libexec/sssd\"
-DSSSD_INTROSPECT_PATH=\"\" -DSSSD_CONF_DIR=\"/etc/sssd\"
-DSSS_NSS_MCACHE_DIR=
\"/var/lib/sss/mc\" -DSSS_NSS_SOCKET_NAME=\"/var/lib/sss/pipes/nss\"
-DSSS_PAM_SOCKET_NAME=\"/var/lib/sss/pipes/pam\"
-DSSS_PAC_SOCKET_NAME=\"/var/lib/sss/pipes/pac\"
-DSSS_PAM_PRIV_SOCKET_NAME=\"/var/lib/sss/p
ipes/private/pam\" -DSSS_SUDO_SOCKET_NAME=\"/var/lib/sss/pipes/sudo\"
-DSSS_AUTOFS_SOCKET_NAME=\"/var/lib/sss/pipes/autofs\"
-DSSS_SSH_SOCKET_NAME=\"/var/lib/sss/pipes/ssh\" -DLOCALEDIR=\"@localedir@\"
-Wall -W
shadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align
-Wwrite-strings -Werror-implicit-function-declaration -fno-strict-aliasing
-std=gnu99 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
-fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
-D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -MT
src/providers/ldap/sdap_async_services.lo -MD -MP -MF
src/providers/ldap/.dep
s/sdap_async_services.Tpo -c src/providers/ldap/sdap_async_services.c
 -fPIC -DPIC -o src/providers/ldap/.libs/sdap_async_services.o
make[2]: *** [src/providers/ldap/sdap_async.lo] Error 1
make[2]: *** Waiting for unfinished jobs....

gcc -DHAVE_CONFIG_H -I. -I. -I. -Wall -Iinclude -I.. -I./include
-I./src/sss_client -I./src -Iinclude -I. -I/usr/include/dbus-1.0
-I/usr/lib64/dbus-1.0/include -I/usr/include/openldap24
-I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include
-DLIBDIR=\"/usr/lib64\" -DVARDIR=\"/var\" -DSHLIBEXT=\"\"
-DSSSD_LIBEXEC_PATH=\"/usr/libexec/sssd\" -DSSSD_INTROSPECT_PATH=\"\"
-DSSSD_CONF_DIR=\"/etc/sssd\" -DSSS_NSS_MCACHE_DIR=\"/var/lib/sss/mc\"
-DSSS_NSS_SOCKET_NAME=\"/var/lib/sss/pipes/nss\"
-DSSS_PAM_SOCKET_NAME=\"/var/lib/sss/pipes/pam\"
-DSSS_PAC_SOCKET_NAME=\"/var/lib/sss/pipes/pac\"
-DSSS_PAM_PRIV_SOCKET_NAME=\"/var/lib/sss/pipes/private/pam\"
-DSSS_SUDO_SOCKET_NAME=\"/var/lib/sss/pipes/sudo\"
-DSSS_AUTOFS_SOCKET_NAME=\"/var/lib/sss/pipes/autofs\"
-DSSS_SSH_SOCKET_NAME=\"/var/lib/sss/pipes/ssh\" -DLOCALEDIR=\"@localedir@\"
-Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align
-Wwrite-strings -Werror-implicit-function-declaration -fno-strict-aliasing
-std=gnu99 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
-fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
-D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -MT
src/providers/ldap/sdap_child_helpers.lo -MD -MP -MF
src/providers/ldap/.deps/sdap_child_helpers.Tpo -c
src/providers/ldap/sdap_child_helpers.c  -fPIC -DPIC -o
src/providers/ldap/.libs/sdap_child_helpers.o
src/providers/ldap/sdap_async_connection.c: In function 'sasl_bind_send':
src/providers/ldap/sdap_async_connection.c:749: warning: statement with no
effect
src/providers/ldap/sdap_async_connection.c:749: error: expected ';' before
string constant
src/providers/ldap/sdap_async_connection.c:751: error: 'ERR_NETWORK_IO'
undeclared (first use in this function)
src/providers/ldap/sdap_async_connection.c:751: error: (Each undeclared
identifier is reported only once
src/providers/ldap/sdap_async_connection.c:751: error: for each function it
appears in.)


gcc -DHAVE_CONFIG_H -I. -I. -I. -Wall -Iinclude -I.. -I./include
-I./src/sss_client -I./src -Iinclude -I. -I/usr/include/dbus-1.0
-I/usr/lib64/dbus-1.0/include -I/usr/include/openldap24
-I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include
-DLIBDIR=\"/usr/lib64\" -DVARDIR=\"/var\" -DSHLIBEXT=\"\"
-DSSSD_LIBEXEC_PATH=\"/usr/libexec/sssd\" -DSSSD_INTROSPECT_PATH=\"\"
-DSSSD_CONF_DIR=\"/etc/sssd\" -DSSS_NSS_MCACHE_DIR=\"/var/lib/sss/mc\"
-DSSS_NSS_SOCKET_NAME=\"/var/lib/sss/pipes/nss\"
-DSSS_PAM_SOCKET_NAME=\"/var/lib/sss/pipes/pam\"
-DSSS_PAC_SOCKET_NAME=\"/var/lib/sss/pipes/pac\"
-DSSS_PAM_PRIV_SOCKET_NAME=\"/var/lib/sss/pipes/private/pam\"
-DSSS_SUDO_SOCKET_NAME=\"/var/lib/sss/pipes/sudo\"
-DSSS_AUTOFS_SOCKET_NAME=\"/var/lib/sss/pipes/autofs\"
-DSSS_SSH_SOCKET_NAME=\"/var/lib/sss/pipes/ssh\" -DLOCALEDIR=\"@localedir@\"
-Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align
-Wwrite-strings -Werror-implicit-function-declaration -fno-strict-aliasing
-std=gnu99 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
-fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
-D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -MT
src/providers/ldap/sdap_idmap.lo -MD -MP -MF
src/providers/ldap/.deps/sdap_idmap.Tpo -c src/providers/ldap/sdap_idmap.c
 -fPIC -DPIC -o src/providers/ldap/.libs/sdap_idmap.o
src/providers/ldap/sdap_async_connection.c: In function 'sdap_rebind_proc':
src/providers/ldap/sdap_async_connection.c:1880: warning: statement with no
effect
src/providers/ldap/sdap_async_connection.c:1880: error: expected ';' before
string constant
src/providers/ldap/sdap_async_connection.c:1882: error: 'ERR_NETWORK_IO'
undeclared (first use in this function)
make[2]: *** [src/providers/ldap/sdap_async_connection.lo] Error 1


On Wed, Aug 13, 2014 at 12:53 AM, Lukas Slebodnik <lslebodn at redhat.com>
wrote:

> On (12/08/14 23:41), Daniel Jung wrote:
> >On 2014-08-12 11:04 PM, Jakub Hrozek wrote:
> >> On Tue, Aug 12, 2014 at 06:36:05PM -0700, Daniel Jung wrote:
> >>> Installed openldap 2.4.23 manually;  There are quite a few packages
> >>> depending on the libldap and liblber which i had to force to reinstall.
> >> force is usually not a good idea in a production environment, I hope it
> >> was a test VM :-)
> >Yep in the VM :)
> >> SSSD already depends on openldap-24 (libldap-2.4.so.2 in particular)
> >> in RHEL5 in order to support the async functionality.
> >>
> >>> It doesnt sigsegv now but i am getting
> >>> Wed Aug 13 03:09:37:761645 2014) [sssd[be[LDAP]]] [sdap_connect_done]
> >>> (0x0080): START TLS result: Success(0), (null)
> >>> (Wed Aug 13 03:09:37:761687 2014) [sssd[be[LDAP]]] [sdap_connect_done]
> >>> (0x0080): ldap_install_tls failed: [Connect error] [unknown error]
> >>>
> >>> And my ldapsearch -ZZ -x doesnt work anymore. Obviously this is bad
> >>> libldap?
> >> Before you upgraded to 2.4, did ldapsearch -ZZ work OK?
> >ldapsearch -ZZ worked before upgrading openldap to 2.4.23 from 19
> >>> So using 1.5.1, my ldapsearch -ZZ works fine but sssd_be sigsegv when
> >>> trying to use pam with password. And using 1.9.6 with openldap-2.4 lib,
> >>> sssd with pam + password doesnt work plus and it doesnt work with
> >>> ldapsearch ( this probably has to do with compat+ldap ?)
> >>>
> >>> Anyone out there using sssd in centos 5 with PAM + password auth?
> >> I don't have a RHEL-5 VM around at the moment, but our QE qualifies the
> >> LDAP authentication on RHEL-5...
> >>
> >> The places in code that did segfault for you was patched upstream:
> >>
> https://git.fedorahosted.org/cgit/sssd.git/commit/?id=7ab7fd0b4e4efd80113aa289115153dabb8fac27
> >>
> https://git.fedorahosted.org/cgit/sssd.git/commit/?id=5fe6ca5e339fd345119752e996c14edf8db57660
> >>
> >> But I wouldn't expect you to hit those issues except for a very busy
> >> environment where servers come and go...
> >We do have LDAP idle timeout as 1 min on the server side as we do have a
> >lot of connections.  Curious of those patches made to sssd.1.5.1 latest
> >package avail from the repo?
>
> It should not be problem to backport patch to 1-9 branch
>
> LS
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20140815/7e8bc3b7/attachment-0001.html>


More information about the sssd-users mailing list