[SSSD-users] Unexpected result from ldap: Referral(10), 0000202B: RefErr: DSID-0310082F

Carl Pettersson (EXT BN) carl.pettersson at bonniernews.se
Wed Jun 24 17:55:28 UTC 2015


Hi,
We're getting this referral related error in our sssd installation. Some environment information:
* CentOS 6.6 clients, sssd v1.11.6
* Windows 2012R2 domain controllers, 2008R2 functional level, single domain forest. Let's call it ad.example.com.
* We have one-way trusts to several other domains/forests, a.foo,com, b.bar.com and c.baz.com

We've joined the clients with adcli, and we can successfully authenticate with accounts from the ad.example.com domain. It is also possible to
kinit myuser at A.FOO.COM

but this fails:
getent passwd myuser at a.foo.com

Looking at the logs (after setting debug_level=8), I can see this error message:

(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_process_result] (0x2000): Trace: sh[0xda3140], connected[1], ops[0xda1480], ldap[0xda3720]
(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0400): Search result: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points
        ref 1: 'a.foo.com'

(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points
        ref 1: 'a.foo.com'

(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [5]: Input/output error
(Wed Jun 24 19:43:47 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_users_done] (0x0040): Failed to retrieve users

(There's also a row slightly after, "[ad_account_info_complete] (0x0010): Bug: dp_error is OK on failed request", unclear if this is related, or actually a separate bug)

I first interpreted this as indicating that I needed to allow referral chasing, but when I turn that on (via ldap_referrals = true), but aside from taking much longer, it still errors:

                (Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_process_result] (0x2000): Trace: sh[0xe4b9b0], connected[1], ops[0xe4c540], ldap[0xe50a40]
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://a.foo.com/dc=a,dc=foo,dc=com] with fd [25].
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error]
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://a.foo.com/dc=a,dc=foo,dc=com].
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0400): Search result: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points
        ref 1: 'a.foo.com'

(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Referral(10), 0000202B: RefErr: DSID-0310082F, data 0, 1 access points
        ref 1: 'a.foo.com'

(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [5]: Input/output error
(Wed Jun 24 19:42:22 2015) [sssd[be[AD.EXAMPLE.COM]]] [sdap_get_users_done] (0x0040): Failed to retrieve users

I also suspected networking issues a while, but a Windows client on the same subnet can authenticate fine (we only do subnet filtering in our firewalls).

Here are my configuration files:
sssd.conf:
[sssd]
services = nss, pam, ssh, autofs
config_file_version = 2
domains = AD.EXAMPLE.COM

[nss]
override_homedir = /home/%d/%u
override_shell = /bin/bash

[domain/AD.EXAMPLE.COM]
debug_level = 8
id_provider = ad
use_fully_qualified_names = TRUE

krb5.conf:
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = AD.EXAMPLE.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

# I found documentation indicating that these should be commented out while troubleshooting
# Commenting in/out does not seem to affect the problem, however.
[realms]
# AD.EXAMPLE.COM = {
#  kdc = ad102.ad.example.com
#  kdc = ad201.ad.example.com
#  admin_server = ad201.ad.example.com
# }

[domain_realm]
# .ad.example.com = AD.EXAMPLE.COM
# ad.example.com = AD.EXAMPLE.COM

What have we done wrong?

Best regards,
Carl
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150624/09c939ed/attachment-0001.html>


More information about the sssd-users mailing list