<div dir="ltr"><div><div><div>my bad.. yes.. that was because of sanitization.. Here
is the complete sssd.conf. <br><br>Log file after debug level 9 is big and exceeds the mailing list limits. Is it okay to send it to you directly?<br></div><br>[sssd]<br>domains = <a href="http://example.com">example.com</a><span class="im"><br>services = nss, pam, sudo<br>config_file_version = 2<br>debug_level = 0<br><br>[nss]<br><br>[pam]<br><br>[sudo]<br>debug_level=2<br><br></span>[domain/<a href="http://example.com">example.com</a>]<br>debug_level=9<br>ad_server = <a href="http://server.example.com">server.example.com</a><span class="im"><br>id_provider = ad<br>auth_provider = ad<br>access_provider = ldap<br>sudo_provider = ad<br>ldap_id_mapping = true<br></span>ldap_use_tokengroups = False<br>ldap_sasl_mech = GSSAPI<br>krb5_realm = <a href="http://EXAMPLE.COM">EXAMPLE.COM</a><br>ldap_uri = ldap://<a href="http://server.example.com">server.example.com</a><br>ldap_sudo_search_base = ou=a,ou=b,ou=c HQ,ou=d,ou=e,dc=example,dc=com<br>ldap_user_search_base = dc=example,dc=com<br>ldap_user_object_class = user<br>ldap_group_search_base = ou=a,ou=b,ou=c HQ,ou=d,ou=e,dc=example,dc=com<span class="im"><br>ldap_group_object_class = group<br>ldap_user_home_directory = unixHomeDirectory<br>ldap_user_principal = userPrincipalName<br>ldap_access_order = filter, expire<br>ldap_account_expire_policy = ad<br></span>ldap_access_filter = memberOf=cn=Group_Name,ou=a,ou=b,ou=c HQ,ou=d,ou=e,dc=example,dc=com<span class="im"><br>cache_credentials = true<br>override_homedir = /home/%d/%u<br>default_shell = /bin/bash<br>ldap_schema = ad<br><br><br></span></div>Many Thanks,<br><br></div>~ Abhi</div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Aug 25, 2015 at 12:31 PM, Lukas Slebodnik <span dir="ltr"><<a href="mailto:lslebodn@redhat.com" target="_blank">lslebodn@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On (25/08/15 11:27), Abhijit Tikekar wrote:<br>
>Thanks for the assistance.<br>
><br>
><br>
>In one of the setups, with Version 1.12.4, we were able to resolve this by<br>
>adding ldap_use_tokengroups = False<br>
> to sssd/conf. ( <a href="https://fedorahosted.org/sssd/ticket/2472" rel="noreferrer" target="_blank">https://fedorahosted.org/sssd/ticket/2472</a>)<br>
>After adding this, all the group names are being resolved correctly and<br>
>only GID's are being recorded.(No SID's). Since it's now resolving names<br>
>correctly, sudo works as well.<br>
><br>
>On another machine, with the exact same version, this change did not work<br>
>as expected. It does pull only GID's now for the "id" command, but a<br>
>majority of the group names are not resolved(Only GID is displayed). I've<br>
>compared all the configurations files and they are identical. Both are<br>
>looking at the same domain controller and have same ldap search base<br>
>configured in sssd.conf. Also cleared the cache but "id" result stays the<br>
>same.<br>
><br>
>The only difference between these two is that the first one(where sssd<br>
>works fine now) was created with CentOS 6.7/2.6.32-573. The other one was<br>
>updated to latest from 6.6/504.<br>
><br>
>Steps used to Join:<br>
><br>
><br>
>1. Configured krb5.conf<br>
>2. Configured smb.conf<br>
>3. kinit <username><br>
>4. net ads join -k<br>
>5. kinit -k HOSTNAME$<br>
>6. net ads keytab create<br>
>7. net ads keytab add host/hostname.domain@DOMAIN<br>
><br>
> Testing the join with "net ads testjoin"<br>
><br>
><br>
>8. Configured sssd.conf<br>
>9. authconfig --enablesssd --enablesssdauth --enablemkhomedir --update<br>
>10.Configured /etc/nsswitch to use sss for sudo as well. Added "sudoers:<br>
>files sss"<br>
><br>
>11.service sssd start<br>
><br>
><br>
</div></div>>*SSSD Configuration:*<br>
><br>
>[sssd]<br>
>domains =<br>
^^<br>
There is amissing name of existing domain<br>
Is it result of sanitisation of sssd.conf?<br>
<span class="">>services = nss, pam, sudo<br>
>config_file_version = 2<br>
>debug_level = 0<br>
><br>
>[nss]<br>
><br>
>[pam]<br>
><br>
>[sudo]<br>
>debug_level=2<br>
><br>
>[domain/]<br>
</span> ^^<br>
There is a missing name.<br>
Is it result of sanitisation of sssd.conf?<br>
BTW You can replace it with <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> for such purpose.<br>
<span class=""><br>
>debug_level=4<br>
>ad_server =<br>
>id_provider = ad<br>
>auth_provider = ad<br>
>access_provider = ldap<br>
>sudo_provider = ad<br>
>ldap_id_mapping = true<br>
</span>>*ldap_use_tokengroups = False*<br>
<span class="">>ldap_sasl_mech = GSSAPI<br>
>krb5_realm =<br>
>ldap_uri = ldap://<br>
>ldap_sudo_search_base =<br>
>ldap_user_search_base =<br>
>ldap_user_object_class = user<br>
>ldap_group_search_base =<br>
>ldap_group_object_class = group<br>
>ldap_user_home_directory = unixHomeDirectory<br>
>ldap_user_principal = userPrincipalName<br>
>ldap_access_order = filter, expire<br>
>ldap_account_expire_policy = ad<br>
>ldap_access_filter = memberOf=<br>
>cache_credentials = true<br>
>override_homedir = /home/%d/%u<br>
>default_shell = /bin/bash<br>
>ldap_schema = ad<br>
><br>
><br>
>@ Pavel.. Does Debug level needs to be anything specific. I tried level 4<br>
>but did not see anything peculiar in the logs. Probably needs higher. I'll<br>
>sanitize logs little bit and will post them here.<br>
><br>
</span>There should be at least some messages with debug level 4<br>
but for troubleshooting it's better to use the highest value (9)<br>
<div class="HOEnZb"><div class="h5"><br>
LS<br>
_______________________________________________<br>
sssd-users mailing list<br>
<a href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
</div></div></blockquote></div><br></div>