[SSSD-users] sssd with samba - Could not add domain to ID map

Jonathan Hunter jmhunter1 at gmail.com
Sat Jun 13 11:53:05 UTC 2015


Thank you Lukas - appreciated.

For the benefit of the archives, this fixed it for me:

rm /var/lib/sss/db/*

Thanks!

Jonathan

On 12 June 2015 at 08:03, Lukas Slebodnik <lslebodn at redhat.com> wrote:
> On (12/06/15 00:03), Jonathan Hunter wrote:
>>Hi,
>>
>>I have what I believe is a minimal sssd.conf (running on CentOS 6.6)
>>that has previously worked fine without the line "ldap_id_mapping =
>>False".
>>
>>I recently had to add rfc2307 attributes to AD (long story), and
>>therefore added the line "ldap_id_mapping = False" to my sssd.conf...
>>at which point sssd will now no longer start (it's fine if I remove
>>this line, but of course returns the wrong information).
>>
>>Relevant log messages (obtained using 'sssd -i -d 0x03f0') might be these ones:
>>
>>(Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]]
>>[sdap_idmap_init] (0x0100): Initializing [1] domains for ID-mapping
>>(Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]]
>>[sdap_idmap_add_domain] (0x0020): Could not add domain
>>[mydomain.my.tld] to the map: [11]
>>(Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]]
>>[sdap_idmap_init] (0x0020): Could not add domain
>>[mydomain.my.tld][S-1-5-21-xxxxxxxxxx-yyyyyyyyyy-zzzzzzzzzz][7091] to
>>ID map: [Input/output error]
>>(Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]]
>>[load_backend_module] (0x0010): Error (5) in module (ad)
>>initialization (sssm_ad_id_init)!
>>(Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]]
>>[be_process_init] (0x0010): fatal error initializing data providers
>>(Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]] [main]
>>(0x0010): Could not initialize backend [5]
>>(Thu Jun 11 23:55:11 2015) [sssd] [mt_svc_exit_handler] (0x0040):
>>Child [mydomain.my.tld] exited with code [3]
>>(Thu Jun 11 23:55:11 2015) [sssd] [mt_svc_exit_handler] (0x0010):
>>Process [mydomain.my.tld], definitely stopped!
>>
>>My sssd.conf is:
>>
>>[sssd]
>>config_file_version = 2
>>domains = mydomain.my.tld
>>services = nss, pam
>>[domain/mydomain.my.tld]
>>id_provider = ad
>>auth_provider = ad
>>access_provider = ad
>>ldap_id_mapping = False
>>
>>What are the best troubleshooting steps I can take next?
>>
> man sssd-ldap -> ID MAPPING -> 3rd paragraph says:
>        Please note that changing the ID mapping related configuration options
>        will cause user and group IDs to change. At the moment, SSSD does not
>        support changing IDs, so the SSSD database must be removed. Because
>        cached passwords are also stored in the database, removing the database
>        should only be performed while the authentication servers are
>        reachable, otherwise users might get locked out. In order to cache the
>        password, an authentication must be performed. It is not sufficient to
>        use sss_cache(8) to remove the database, rather the process consists
>        of:
>
>        ·   Making sure the remote servers are reachable
>        ·   Stopping the SSSD service
>        ·   Removing the database
>        ·   Starting the SSSD service
>
> LS
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users



-- 
"If we knew what it was we were doing, it would not be called
research, would it?"
      - Albert Einstein


More information about the sssd-users mailing list