[SSSD-users] sssd not authentication with user in random groups

Mullan, Allan Allan.Mullan at informa.com
Wed Feb 11 13:39:21 UTC 2015


The logs show the following:

(Wed Feb 11 13:36:33 2015) [sssd[be[UK.CorpLAN.net]]] [simple_resolve_group_done] (0x0040): Refresh failed
(Wed Feb 11 13:36:33 2015) [sssd[be[UK.CorpLAN.net]]] [simple_check_get_groups_next] (0x0040): Could not resolve name of group with GID 1749812073
(Wed Feb 11 13:36:33 2015) [sssd[be[UK.CorpLAN.net]]] [simple_access_check_done] (0x0040): Could not collect groups of user testuseramm

The secure log is displaying the following:

Feb 11 13:38:40 uksn-test01 sshd[25114]: pam_sss(sshd:account): Access denied for user testuseramm: 4 (System error)

Hope this helps?


-----Original Message-----
From: sssd-users-bounces at lists.fedorahosted.org [mailto:sssd-users-bounces at lists.fedorahosted.org] On Behalf Of Lukas Slebodnik
Sent: 11 February 2015 13:26
To: End-user discussions about the System Security Services Daemon
Subject: Re: [SSSD-users] sssd not authentication with user in random groups

On (11/02/15 13:20), Mullan, Allan wrote:
>Good afternoon,
>
>I've been playing around with sssd for a while not and it's been great but I've just run into a really weird problem. If I have a user specified in the 'simple_allow_users' configuration directive it works absolutely fine BUT I've got (at least) 2 groups that, for some reason, if the user is a member of these groups the account can't authenticate on my boxes. The groups that I'm having problems with are nothing to do with any simple_allow_groups - they're just normal AD security groups...
>
>Can someone please point me in the right direction on this one or let me know how I can best find out why these groups are affecting sssd? I've been trawling logs but can't seem to find anything obvious.
Which version of sssd do you use?

Which pam return code was returned?

I would suggest to start debugging with small debug level (0x00F0) and then you can increase to full debug level (0xFFF0)

If you have alredy log files with full debug level it is easy to filter the most critical with grep command.

grep -E "\(0x00[1-9]0\)" sssd_domain.log

LS
_______________________________________________
sssd-users mailing list
sssd-users at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


More information about the sssd-users mailing list