<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 09/12/2013 10:02 AM, Bright, Daniel wrote:
<blockquote
cite="mid:F990AEA781BC8E44914F552260F6B787164D9A6F@CHO3WUC9MBX11.corp.transunion.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:"Calibri","sans-serif";
        color:windowtext;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-family:"Calibri","sans-serif";}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif][if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Jakub, I took your advice and turned
debugging to level 9, this is what I am seeing in the logs:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">=======================================================================================================<o:p></o:p></p>
<p class="MsoNormal">[<a class="moz-txt-link-abbreviated" href="mailto:root@some.server.com">root@some.server.com</a> sssd]# tail -f
sssd_LDAP.log | grep sdap_exop<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_send] (0x0100): Executing extended
operation<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_send] (0x2000):
ldap_extended_operation sent, msgid = 3<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_done] (0x0200): Server returned no
controls.<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_done] (0x0080):
ldap_extended_operation result: Constraint violation(19),
Failed to update password<o:p></o:p></p>
<p class="MsoNormal">=======================================================================================================<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is some more relevant log information:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">=======================================================================================================<o:p></o:p></p>
<p class="MsoNormal">[<a class="moz-txt-link-abbreviated" href="mailto:root@some.server.com">root@some.server.com</a> sssd]# tail -f
sssd_LDAP.log | grep sdap_exop<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_send] (0x0100): Executing extended
operation<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_send] (0x2000):
ldap_extended_operation sent, msgid = 3<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_done] (0x0200): Server returned no
controls.<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_done] (0x0080):
ldap_extended_operation result: Constraint violation(19),
Failed to update password<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_sys_connect_done] (0x0100): Executing START TLS<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_process_result] (0x2000): Trace: sh[0x90d340],
connected[1], ops[0x9cb7d0], ldap[0x9e8030]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_process_message] (0x4000): Message type:
[LDAP_RES_EXTENDED]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_connect_done] (0x0080): START TLS result: Success(0),
Start TLS request accepted.Server willing to negotiate SSL.<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[fo_set_port_status] (0x0100): Marking port 389 of server
'atl01osd110.vsi.com' as 'working'<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[set_server_common_status] (0x0100): Marking server
'atl01osd110.vsi.com' as 'working'<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[ldb] (0x4000): Added timed event "ltdb_callback": 0x98db10<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[ldb] (0x4000): Added timed event "ltdb_timeout": 0x9e8cf0<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[ldb] (0x4000): Destroying timer event 0x9e8cf0 "ltdb_timeout"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[ldb] (0x4000): Ending timer event 0x98db10 "ltdb_callback"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[find_password_expiration_attributes] (0x4000): No password
policy requested.<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[simple_bind_send] (0x0100): Executing simple bind as:
uid=user1,ou=People,dc=some,dc=company,dc=com<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[simple_bind_send] (0x2000): ldap simple bind sent, msgid = 2<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_process_result] (0x2000): Trace: sh[0x90d340],
connected[1], ops[0x900e80], ldap[0x9e8030]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_process_result] (0x2000): Trace: ldap_result found
nothing!<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_process_result] (0x2000): Trace: sh[0x90d340],
connected[1], ops[0x900e80], ldap[0x9e8030]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_process_message] (0x4000): Message type: [LDAP_RES_BIND]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[simple_bind_done] (0x2000): Server returned control
[1.3.6.1.4.1.42.2.27.8.5.1].<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[simple_bind_done] (0x1000): Password Policy Response: expire
[346806] grace [-1] error [No error].<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[simple_bind_done] (0x1000): Password will expire in [346806]
seconds.<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[simple_bind_done] (0x2000): Server returned control
[2.16.840.1.113730.3.4.5].<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[simple_bind_done] (0x1000): Password will expire in [346806]
seconds.<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[simple_bind_done] (0x0400): Bind result: Success(0), no
errmsg set<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[auth_bind_user_done] (0x4000): Found ppolicy data, assuming
LDAP password policies are active.<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_auth4chpass_done] (0x1000): user
[uid=user1,ou=People,dc=some,dc=company,dc=com] successfully
authenticated.<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_control_create] (0x0080): Server does not support the
requested control [1.3.6.1.4.1.42.2.27.8.5.1].</p>
</div>
</blockquote>
<br>
<br>
This is the problem. Please check your DS.<br>
On the SSSD side it was fixed in sssd-1.5.1-51.el6 so it might be
something going on the DS configuration side.<br>
<br>
<blockquote
cite="mid:F990AEA781BC8E44914F552260F6B787164D9A6F@CHO3WUC9MBX11.corp.transunion.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_send] (0x0100): Executing extended
operation<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_send] (0x2000):
ldap_extended_operation sent, msgid = 3<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_process_result] (0x2000): Trace: sh[0x90d340],
connected[1], ops[0x9bf740], ldap[0x9e8030]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_process_result] (0x2000): Trace: ldap_result found
nothing!<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_process_result] (0x2000): Trace: sh[0x90d340],
connected[1], ops[0x9bf740], ldap[0x9e8030]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_process_message] (0x4000): Message type:
[LDAP_RES_EXTENDED]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_done] (0x0200): Server returned no
controls.<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_exop_modify_passwd_done] (0x0080):
ldap_extended_operation result: Constraint violation(19),
Failed to update password<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[be_pam_handler_callback] (0x0100): Backend returned: (3, 12,
<NULL>) [Internal Error (Authentication token is no
longer valid; new one required)]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[be_pam_handler_callback] (0x0100): Sending result [12][LDAP]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[be_pam_handler_callback] (0x0100): Sent result [12][LDAP]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[sdap_handle_release] (0x2000): Trace: sh[0x90d340],
connected[1], ops[(nil)], ldap[0x9e8030], destructor_lock[0],
release_memory[0]<o:p></o:p></p>
<p class="MsoNormal">(Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]]
[remove_connection_callback] (0x4000): Successfully removed
connection callback.<o:p></o:p></p>
<p class="MsoNormal">=======================================================================================================<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I noticed it says “Server does not support
the requested control [1.3.6.1.4.1.42.2.27.8.5.1]” looking at
my 389-ds schema my password policy OID =
2.16.840.1.113730.3.2.13, could this be the issue?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Daniel B.<o:p></o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
sssd-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>