[SSSD-users] sssd auth issue on centos 5.10

Lukas Slebodnik lslebodn at redhat.com
Wed Aug 20 07:44:57 UTC 2014


On (19/08/14 16:37), Daniel Jung wrote:
>Still seeing sssd[be[LDAP]]: Could not start TLS encryption. unknown error
>
>Wed Aug 20 01:27:53:174091 2014) [sssd[be[LDAP]]] [sdap_sys_connect_done]
>(0x0100): Executing START TLS
>(Wed Aug 20 01:27:53:174891 2014) [sssd[be[LDAP]]] [sdap_connect_done]
>(0x0080): START TLS result: Success(0), (null)
>(Wed Aug 20 01:27:53:174930 2014) [sssd[be[LDAP]]] [sdap_connect_done]
>(0x0080): ldap_install_tls failed: [Connect error] [unknown error]
>
>As a recap, openldap user land tools works using -ZZ. upgraded sssd to
>1.9.6, upgraded openldap lib to 2.4.39. Any other ideas?
>
>By the way, what was the main decision for compiling against openldap 2.4
>when other critical package still compiles against 2.3 ldap lib? Making the
>upgrade path to openldap 2.4 very difficult.
>
Patch from previous mail just fixed crash.
SSSD can try to reconnect after few seconds (value of "offline_timeout")

It is not clear from previous log file; It can be problem with long synchronous
calls. You can try to modify some timeout options:

       ldap_network_timeout (integer)
           Specifies the timeout (in seconds) after which the
           poll(2)/select(2) following a connect(2) returns in case of no
           activity.

           Default: 6

       ldap_opt_timeout (integer)
           Specifies a timeout (in seconds) after which calls to synchronous
           LDAP APIs will abort if no response is received. Also controls the
           timeout when communicating with the KDC in case of SASL bind.

           Default: 6

other options in man sssd-ldap

LS


More information about the sssd-users mailing list