<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:#0563C1;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:#954F72;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:"Calibri",sans-serif;
        color:windowtext;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-family:"Calibri",sans-serif;}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I’ve gotten logins to work from our AD, but for some reason after a while they just stop working again. I’m using Ubuntu 14.04.1, sssd 1.12.5.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I don’t know why it’s trying to contact the AD over 389. We only allow ldaps 636 connections to the AD. I’m not sure how it’s initially allowing logins and then
suddenly can’t resolve the AD servers.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Sssd log file:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_step] (0x4000): beginning to connect<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc01.ad.mydomain.com' is 'name resolved'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc01.ad.mydomain.com' is 'not working'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc06.ad.mydomain.com' is 'name resolved'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc06.ad.mydomain.com' is 'not working'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc04.ad.mydomain.com' is 'name resolved'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc04.ad.mydomain.com' is 'not working'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc05.ad.mydomain.com' is 'name resolved'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc05.ad.mydomain.com' is 'not working'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc02.ad.mydomain.com' is 'name resolved'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc02.ad.mydomain.com' is 'not working'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'udc03.ad.mydomain.com' is 'name resolved'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'udc03.ad.mydomain.com' is 'not working'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'cdc02.ad.mydomain.com' is 'name resolved'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'cdc02.ad.mydomain.com' is 'not working'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_server_status] (0x1000): Status of server 'cdc01.ad.mydomain.com' is 'name resolved'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'cdc01.ad.mydomain.com' is 'not working'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): attempting failover retry on op #2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_step] (0x4000): waiting for connection to complete<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [child_sig_handler] (0x1000): Waiting for child [19728].<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [child_sig_handler] (0x0100): child [19728] finished successfully.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_mark_offline] (0x2000): Going offline!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_mark_offline] (0x2000): Enable check_if_online_ptask.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_ptask_enable] (0x0400): Task [Check if online (periodic)]: enabling task<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_ptask_schedule] (0x0400): Task [Check if online (periodic)]: scheduling task 87 seconds from now [1439311309]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_subdomains_get_conn_done] (0x0080): No AD server is available, cannot get the subdomain list while
offline<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_dyndns_get_addrs_done] (0x0080): No LDAP server is available, dynamic DNS update is skipped in offline
mode.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_dyndns_update_addrs_done] (0x0040): Can't get addresses for DNS update<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158234]: Dynamic DNS update not possible
while offline<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [ad_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [1432158234]: Dynamic DNS update not possible
while offline<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:22 2015) [sssd[be[ad.mydomain.com]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">(Tue Aug 11 11:40:23 2015) [sssd[be[ad.mydomain.com]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.AD.MYDOMAIN.COM],
[2][No such file or directory]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">sssd.conf<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">[sssd]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">domains = ad.mydomain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">config_file_version = 2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">services = nss, pam<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">[nss]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">#debug_level = 9<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">[domain/ad.mydomain.com]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">debug_level = 9<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ad_domain = ad.mydomain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">id_provider = ad<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">auth_provider = ad<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">access_provider = ad<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">chpass_provider = ad<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">override_gid = 760429<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">#krb5_realm = AD.MYDOMAIN.COM<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">realmd_tags = manages-system joined-with-samba
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">cache_credentials = True<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">krb5_store_password_if_offline = True<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">default_shell = /bin/bash<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ldap_id_mapping = False<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">use_fully_qualified_names = False<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">fallback_homedir = /home/%u<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ignore_group_members = False<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">simple_allow_groups = Group 1, Group 2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
</div>
</body>
</html>