<div dir="ltr"><div>Hello, all this to inform you all of the solution to the problem I encountered.</div><div><br></div><div>It of course follows what is often said on this list, don't add ldap parameters unless you really know what you're doing.</div>
<div><br></div><div>I had an ldap_search_base that was set to an OU, and SSSD needed access to a lower level of the AD structure than was allowed by my search base setting.</div><div><br></div><div>I of course thought setting that would optimize the queries to AD, as all the accounts were below the OU I had specified. I was incorrect. </div>
<div><br></div><div>Sumit from RedHat helped me out and suggested removing the search base.</div><div><br></div><div>Thanks!</div><div>Chris</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jan 10, 2014 at 3:06 AM, Chris Gray <span dir="ltr"><<a href="mailto:fathed@gmail.com" target="_blank">fathed@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I'll check with my security team, and hopefully be able to send them to you tomorrow. I might do so from my work email account, but I'll mention my gmail address on there as well.<div>
<br></div><div>
I assume you'll want a copy the configuration files, so I'll send those with the logs if I'm able.</div><div><br></div><div>Unfortunately gmail didn't notify me of your response (or I missed it), while I was sending that one. </div>
<div><br></div><div>Thanks again!</div><span class="HOEnZb"><font color="#888888"><div>Chris</div></font></span></div><div class="gmail_extra"><div><div class="h5"><br><br><div class="gmail_quote">On Fri, Jan 10, 2014 at 3:01 AM, Sumit Bose <span dir="ltr"><<a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div>On Fri, Jan 10, 2014 at 02:32:48AM -0800, Chris Gray wrote:<br>
> I'll install the ldb-tools tomorrow (I went home) and try that out.<br>
><br>
> The SID and the RID are correct, verified visually and used a windows<br>
> utility to search the domain based on the SID to verify it was correct and<br>
> returning the correct account from AD (psgetsid.exe). I'm also working on<br>
> converting the SID and RID to reverse hex so I can use ldapsearch on the<br>
> linux machine to triple verify, but I haven't completed that yet.<br>
><br>
> The computers with SSSD version 1.9 correctly show the RID as the last<br>
> digits of the unix UID. My default domain group is Domain Users as well,<br>
> which always has a RID of 0513, and that correctly shows as the last 4<br>
> digits unix GID on the computers with 1.9.<br>
><br>
> Reading those bug reports more may had lead to a solution.<br>
><br>
> ldap_idmap_default_domain_sid (string)<br>
> Specify the domain SID of the default domain. This will<br>
> guarantee that this domain will always be assigned to slice<br>
> zero in the ID map, bypassing the murmurhash algorithm<br>
> described above.<br>
><br>
> Default: not set<br>
><br>
> ldap_idmap_default_domain (string)<br>
> Specify the name of the default domain.<br>
><br>
> Default: not set<br>
><br>
<br>
</div>Please note that those options have a special purpose and should not be<br>
needed in your setup. Nevertheless they might lead to a working<br>
solution by hiding the original issue. With those two option a domain is<br>
pre-created in the idmapping code. If the SID matches the domain SID of<br>
your user the user will get a POSIX ID and you won't see the errors you<br>
posted earlier. But in general the AD provider is able to auto-detect all<br>
domain in your forest and create the needed idmapping entries<br>
automatically. I assume that there is an issue to detect of domain and<br>
its domain SID or to create the needed idmapping entries. This is why I<br>
asekd for the full logs.<br>
<br>
bye,<br>
Sumit<br>
<div><br>
><br>
><br>
> I'll try those out tomorrow as well. I'm not sure they'll work since I<br>
> got them from version 1.9 docs. I don't have them set on the computers<br>
> I have that use SSSD 1.9, and they don't exhibit the problem.<br>
><br>
><br>
> Thanks again,<br>
><br>
> Chris<br>
<br>
</div><div><div>> _______________________________________________<br>
> sssd-users mailing list<br>
> <a href="mailto:sssd-users@lists.fedorahosted.org" target="_blank">sssd-users@lists.fedorahosted.org</a><br>
> <a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
<br>
_______________________________________________<br>
sssd-users mailing list<br>
<a href="mailto:sssd-users@lists.fedorahosted.org" target="_blank">sssd-users@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div></div></div><div class="im">-- <br>Intelligence is a matter of opinion.
</div></div>
</blockquote></div><br><br clear="all"><br>-- <br>Intelligence is a matter of opinion.
</div>