[SSSD-users] sssd with ad backend, pam problems

Lukas Slebodnik lslebodn at redhat.com
Thu Aug 28 15:05:01 UTC 2014


On (28/08/14 16:56), Stefan Schäfer wrote:
>Am 28.08.2014 16:44, schrieb Rowland Penny:
>>On 28/08/14 15:41, Stefan Schäfer wrote:
>>>Am 28.08.2014 16:18, schrieb Lukas Slebodnik:
>>>>>Could you put debug_level = 7 into domain section (in
>>>>/etc/sssd/sssd.conf)
>>>>>then restart sssd; login as samba user;
>>>>>
>>>>>You should find a reason in sssd_invis-ad.loc.log file (/var/log/sssd)
>>>>>why sssd returned  4 (System error)
>>>I increased the debug_level to 7, but in the sssd_invis-ad.loc.log didn't
>>>appear a single entry.
>>>
>>>The same is to the other log files sssd_pam.log and sssd_nss.log. The
>>>only log are these in /var/log/messages.
>>>
>>>Seems that for sssd everything is ok and pam causes the problem?
>>>
>>>Stefan
>>>
>>You need to put the debug level into each section of the sssd.conf, not
>>just once.
>>
>>Rowland
>>

//snip

>(0x0400): Performing access check for user [hbecker]
>(Thu Aug 28 16:51:28 2014) [sssd[be[invis-ad.loc]]] [sdap_account_expired_ad]
>(0x0400): Performing AD access check for user [hbecker]
>(Thu Aug 28 16:51:28 2014) [sssd[be[invis-ad.loc]]] [ad_gpo_connect_done]
>(0x0400): sam_account_name is invisad.invis-ad.loc$
>(Thu Aug 28 16:51:28 2014) [sssd[be[invis-ad.loc]]]
>[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectclass=user)(sAMAccountName=invisad.invis-ad.loc$))][dc=invis-ad,dc=loc].
>(Thu Aug 28 16:51:28 2014) [sssd[be[invis-ad.loc]]]
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [distinguishedName]
>(Thu Aug 28 16:51:28 2014) [sssd[be[invis-ad.loc]]]
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl]
>(Thu Aug 28 16:51:28 2014) [sssd[be[invis-ad.loc]]]
>[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg
>set
>(Thu Aug 28 16:51:28 2014) [sssd[be[invis-ad.loc]]]
>[ad_gpo_target_dn_retrieval_done] (0x0040): No DN retrieved for policy
>target.
>(Thu Aug 28 16:51:28 2014) [sssd[be[invis-ad.loc]]] [ad_gpo_access_done]
>(0x0040): GPO-based access control failed.
I thought it. There is problem with retrieving GPO from samba.

there was bug in 1.12.0 that access control from GPO in permissive did not
work.

You can try to disable GPO:

ad_gpo_access_control = disabled

LS


More information about the sssd-users mailing list