[SSSD-users] Connection to ad via ldap failing
Jakub Hrozek
jhrozek at redhat.com
Wed Jan 29 08:47:49 UTC 2014
On Tue, Jan 28, 2014 at 11:07:03PM +0000, Nordgren, Bryce L -FS wrote:
> Well, I guess the title is a little misleading. The ldap connection is working like a champ. I configured sssd to bind using my own credentials, and that's working. The searches are successful and return the correct result.
>
> Things I don't understand:
>
>
> * Sssd performs two ldap searches for my username, not one.
>
> * Using wireshark, I don't even see it trying to bind to AD using the account it finds (twice).
>
> * sssd fails to authenticate me, but the logs seems to indicate to me that everything it tried succeeded.
>
> This is on a VM with a minimal install of Fedora 19. The setup roughly follows https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate%20with%20a%20Windows%202008%20Domain%20Server with local modifications to enable id mapping. I'm attaching edited versions of sssd.conf, sssd_pam.log, sssd_nss.log, and the output of wireshark (stupidly named sssd.log.) pam and nss are both at debug level 9.
>
I think the most important log would be the one from the back end,
generated by including debug_level in the [domain] section.
Any reason why you set the principal to cn and not userPrincipalName ?
More information about the sssd-users
mailing list