FreeIPA-users October 2026

freeipa-users@lists.fedorahosted.org

9 participants
5 discussions

Freeipa on EL8 has stopped authenticating
by Brian J. Murrell 15 Oct '26

15 Oct '26

My FreeIPA server 4.9.13 on EL8 (yes, I know, it's getting long in the tooth -- I had an EL9 replica that I was using to migrate away from EL8 on but it STB) has started failing user authentications on my network for all services: ssh, sudo, etc. I have no clue why. Here is the output of a few sssd processes when an ssh fails: ==> /var/log/sssd/sssd_nss.log <== (2026-09-24 14:50:27): [nss] [get_client_cred] (0x4000): Client [0x557ffdc04240][21] creds: euid[0] egid[0] pid[943432] cmd_line['sshd-session: brian [priv]']. (2026-09-24 14:50:27): [nss] [setup_client_idle_timer] (0x4000): Idle timer re-set for client [0x557ffdc04240][21] (2026-09-24 14:50:27): [nss] [accept_fd_handler] (0x0400): [CID#58] Client [cmd sshd-session: brian [priv]][uid 0][0x557ffdc04240][21] connected! (2026-09-24 14:50:27): [nss] [sss_cmd_get_version] (0x0200): [CID#58] Received client version [1]. (2026-09-24 14:50:27): [nss] [sss_cmd_get_version] (0x0200): [CID#58] Offered version [1]. (2026-09-24 14:50:27): [nss] [sss_nss_getby_name] (0x0400): [CID#58] Input name: pam_usertype_non_existent: (2026-09-24 14:50:27): [nss] [cache_req_set_plugin] (0x2000): [CID#58] CR #225: Setting "User by name" plugin (2026-09-24 14:50:27): [nss] [cache_req_send] (0x0400): [CID#58] CR #225: REQ_TRACE: New request [CID #58] 'User by name' (2026-09-24 14:50:27): [nss] [cache_req_process_input] (0x0400): [CID#58] CR #225: Parsing input name [pam_usertype_non_existent:] (2026-09-24 14:50:27): [nss] [sss_parse_name] (0x0200): [CID#58] Domain not provided! (2026-09-24 14:50:27): [nss] [sss_parse_name_for_domains] (0x0200): [CID#58] name 'pam_usertype_non_existent:' matched without domain, user is pam_usertype_non_existent: (2026-09-24 14:50:27): [nss] [sss_nss_get_object_send] (0x0400): [CID#58] Client [0x557ffdc04240][21]: sent cache request #225 (2026-09-24 14:50:27): [nss] [cache_req_set_name] (0x0400): [CID#58] CR #225: Setting name [pam_usertype_non_existent:] (2026-09-24 14:50:27): [nss] [cache_req_select_domains] (0x0400): [CID#58] CR #225: Performing a multi-domain search (2026-09-24 14:50:27): [nss] [cache_req_search_domains] (0x0400): [CID#58] CR #225: Search will check the cache and check the data provider (2026-09-24 14:50:27): [nss] [cache_req_validate_domain_type] (0x2000): [CID#58] Request type POSIX-only for domain example.com type POSIX is valid (2026-09-24 14:50:27): [nss] [cache_req_set_domain] (0x0400): [CID#58] CR #225: Using domain [example.com] (2026-09-24 14:50:27): [nss] [cache_req_prepare_domain_data] (0x0400): [CID#58] CR #225: Preparing input data for domain [example.com] rules (2026-09-24 14:50:27): [nss] [cache_req_search_send] (0x0400): [CID#58] CR #225: Looking up pam_usertype_non_existent:@example.com (2026-09-24 14:50:27): [nss] [cache_req_search_ncache] (0x0400): [CID#58] CR #225: Checking negative cache for [pam_usertype_non_existent:@example.com] (2026-09-24 14:50:27): [nss] [sss_ncache_check_str] (0x2000): [CID#58] Checking negative cache for [NCE/USER/example.com/pam_usertype_non_existent:@example.com] (2026-09-24 14:50:27): [nss] [cache_req_search_ncache] (0x0400): [CID#58] CR #225: [pam_usertype_non_existent:@example.com] is not present in negative cache (2026-09-24 14:50:27): [nss] [cache_req_search_cache] (0x0400): [CID#58] CR #225: Looking up [pam_usertype_non_existent:@example.com] in cache (2026-09-24 14:50:27): [nss] [cache_req_search_cache] (0x0400): [CID#58] CR #225: Object [pam_usertype_non_existent:@example.com] was not found in cache (2026-09-24 14:50:27): [nss] [cache_req_search_dp] (0x0400): [CID#58] CR #225: Looking up [pam_usertype_non_existent:@example.com] in data provider (2026-09-24 14:50:27): [nss] [sss_dp_get_account_send] (0x0400): [CID#58] Creating request for [example.com][0x1][BE_REQ_USER][name=pam_usertype_non_existent:@example.com:-] ==> /var/log/sssd/sssd_example.com.log <== (2026-09-24 14:50:27): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd from sssd.nss (2026-09-24 14:50:27): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.nss] (2026-09-24 14:50:27): [be[example.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@example.com] (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#135] DP Request [Account #135]: REQ_TRACE: New request. [sssd.nss CID #58] Flags [0x0001]. (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#135] Number of active DP request: 1 (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#135] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#135] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#135] reusing cached connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#135] Marking connection as not idle (2026-09-24 14:50:27): [be[example.com]] [sdap_search_user_next_base] (0x0400): [RID#135] Searching for users with base [cn=accounts,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#135] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#135] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(uid=pam_usertype_non_existent:)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))] base: [cn=accounts,dc=example,dc=com]; msgid = 85 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [uid] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [userPassword] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [uidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [gidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [gecos] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [homeDirectory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [loginShell] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [krbPrincipalName] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [ipaNTSecurityIdentifier] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [modifyTimestamp] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [entryUSN] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowLastChange] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowMin] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowMax] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowWarning] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowInactive] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowExpire] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowFlag] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [krbLastPwdChange] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [krbPasswordExpiration] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [pwdAttribute] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [authorizedService] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [accountExpires] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [userAccountControl] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [nsAccountLock] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [host] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [loginDisabled] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [loginExpirationTime] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [loginAllowedTimeMap] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [ipaSshPubKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [ipaUserAuthType] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [userCertificate;binary] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [mail] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [sAMAccountName] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [ipaPassKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#135] New operation 85 timeout 6 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0010e0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#135] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#135] Handling LDAP operation [85][server: [10.75.22.247:389] filter: [(&(uid=pam_usertype_non_existent:)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))] base: [cn=accounts,dc=example,dc=com]] took [0.468] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#135] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#135] Operation 85 finished (2026-09-24 14:50:27): [be[example.com]] [sdap_search_user_process] (0x0400): [RID#135] Search for users, returned 0 results. (2026-09-24 14:50:27): [be[example.com]] [sdap_search_user_process] (0x2000): [RID#135] Retrieved total 0 users (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_done] (0x4000): [RID#135] releasing operation connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_idle] (0x4000): [RID#135] Marking connection as idle (2026-09-24 14:50:27): [be[example.com]] [sysdb_search_by_name] (0x0400): [RID#135] No such entry (2026-09-24 14:50:27): [be[example.com]] [sysdb_cache_search_groups] (0x2000): [RID#135] Search groups with filter: (&(objectCategory=group)(ghost=pam_usertype_non_existent:@example.com)) (2026-09-24 14:50:27): [be[example.com]] [sysdb_cache_search_groups] (0x2000): [RID#135] No such entry (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_user] (0x0400): [RID#135] Error: 2 (No such file or directory) (2026-09-24 14:50:27): [be[example.com]] [sysdb_search_by_name] (0x0400): [RID#135] No such entry (2026-09-24 14:50:27): [be[example.com]] [get_object_from_cache] (0x0200): [RID#135] Object wasn't found in cache (2026-09-24 14:50:27): [be[example.com]] [ipa_id_get_account_info_orig_done] (0x0080): [RID#135] Object not found, ending request (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x0400): [RID#135] DP Request [Account #135]: Request handler finished [0]: Success (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x20000): [RID#135] DP Request [Account #135]: Handling request took [1.158] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [_dp_req_recv] (0x0400): [RID#135] DP Request [Account #135]: Receiving request data. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#135] DP Request [Account #135]: Request removed. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#135] Number of active DP request: 0 (2026-09-24 14:50:27): [be[example.com]] [dp_req_reply_std] (0x1000): [RID#135] DP Request [Account #135]: Returning [Success]: 0,0,Success (2026-09-24 14:50:27): [be[example.com]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo on /sssd from sssd.nss: Success (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[(nil)], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list ==> /var/log/sssd/sssd_nss.log <== (2026-09-24 14:50:27): [nss] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [nss] [cache_req_search_cache] (0x0400): [CID#58] CR #225: Looking up [pam_usertype_non_existent:@example.com] in cache (2026-09-24 14:50:27): [nss] [cache_req_search_cache] (0x0400): [CID#58] CR #225: Object [pam_usertype_non_existent:@example.com] was not found in cache (2026-09-24 14:50:27): [nss] [cache_req_search_ncache_add_to_domain] (0x0400): [CID#58] CR #225: Adding [pam_usertype_non_existent:@example.com] to negative cache (2026-09-24 14:50:27): [nss] [sss_ncache_set_str] (0x0400): [CID#58] Adding [NCE/USER/example.com/pam_usertype_non_existent:@example.com] to negative cache (2026-09-24 14:50:27): [nss] [cache_req_global_ncache_add] (0x2000): [CID#58] CR #225: This request type does not support global negative cache (2026-09-24 14:50:27): [nss] [cache_req_process_result] (0x0400): [CID#58] CR #225: Finished: Not found (2026-09-24 14:50:27): [nss] [sss_nss_protocol_done] (0x4000): [CID#58] Sending reply: not found ==> /var/log/sssd/sssd_example.com.log <== (2026-09-24 14:50:27): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd from sssd.pam (2026-09-24 14:50:27): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.pam] (2026-09-24 14:50:27): [be[example.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#136] DP Request [Initgroups #136]: REQ_TRACE: New request. [sssd.pam CID #15] Flags [0x0001]. (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#136] Number of active DP request: 1 (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#136] reusing cached connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#136] Marking connection as not idle (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_send] (0x4000): [RID#136] Retrieving info for initgroups call (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#136] reusing cached connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#136] Marking connection as not idle (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_next_base] (0x0400): [RID#136] Searching for users with base [cn=accounts,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#136] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#136] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(uid=brian)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))] base: [cn=accounts,dc=example,dc=com]; msgid = 86 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [uid] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [userPassword] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [uidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [gidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [gecos] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [homeDirectory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [loginShell] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [krbPrincipalName] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaNTSecurityIdentifier] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [modifyTimestamp] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [entryUSN] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowLastChange] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowMin] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowMax] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowWarning] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowInactive] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowExpire] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowFlag] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [krbLastPwdChange] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [krbPasswordExpiration] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [pwdAttribute] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [authorizedService] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [accountExpires] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [userAccountControl] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [nsAccountLock] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [host] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [loginDisabled] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [loginExpirationTime] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [loginAllowedTimeMap] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaSshPubKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaUserAuthType] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [userCertificate;binary] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [mail] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [sAMAccountName] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaPassKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#136] New operation 86 timeout 6 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edcef6100], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#136] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#136] Handling LDAP operation [86][server: [10.75.22.247:389] filter: [(&(uid=brian)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))] base: [cn=accounts,dc=example,dc=com]] took [0.895] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#136] OriginalDN: [uid=brian,cn=users,cn=accounts,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [uid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [uidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [gidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [gecos] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [homeDirectory] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [loginShell] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [krbPrincipalName] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [ipaNTSecurityIdentifier] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [modifyTimestamp] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [entryUSN] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [krbLastPwdChange] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [krbPasswordExpiration] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [mail] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edcef6100], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#136] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#136] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#136] Operation 86 finished (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_user] (0x4000): [RID#136] Receiving info for the user (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_user] (0x4000): [RID#136] Storing the user (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x0400): [RID#136] Save user (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x4000): [RID#136] Failed to retrieve UUID [2][No such file or directory]. (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object brian (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x0400): [RID#136] Processing user brian(a)example.com (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x2000): [RID#136] Adding originalDN [uid=brian,cn=users,cn=accounts,dc=example,dc=com] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x0400): [RID#136] Adding original memberOf attributes to [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#136] Adding original mod-Timestamp [20260924173633Z] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x0400): [RID#136] Adding user principal [brian(a)EXAMPLE.COM] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowLastChange is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowMin is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowMax is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowWarning is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowInactive is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowExpire is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowFlag is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#136] Adding krbLastPwdChange [20150924101933Z] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#136] Adding krbPasswordExpiration [20700627101933Z] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] pwdAttribute is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] authorizedService is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] adAccountExpires is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] adUserAccountControl is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] nsAccountLock is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] authorizedHost is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] authorizedRHost is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] ndsLoginDisabled is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] ndsLoginExpirationTime is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] ndsLoginAllowedTimeMap is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] sshPublicKey is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] authType is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] userCertificate is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#136] Adding mail [brian(a)example.com] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] adSAMAccountName is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] userPasskey is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x0400): [RID#136] Storing info for user brian(a)example.com (2026-09-24 14:50:27): [be[example.com]] [sysdb_set_entry_attr] (0x0200): [RID#136] Entry [name=brian(a)example.com,cn=users,cn=example.com,cn=sysdb] has set [ts_cache] attrs. (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [userPassword] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [uniqueID] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowLastChange] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowMin] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowMax] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowWarning] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowInactive] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowExpire] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowFlag] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [pwdAttribute] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [authorizedService] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [adAccountExpires] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [adUserAccountControl] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [nsAccountLock] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [authorizedHost] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [ndsLoginDisabled] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [ndsLoginExpirationTime] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [ndsLoginAllowedTimeMap] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [sshPublicKey] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [authType] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [userCertificate] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [adSAMAccountName] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [userPasskey] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_store_user] (0x0400): [RID#136] User "brian(a)example.com" has been stored (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_user] (0x4000): [RID#136] Commit change (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_user] (0x4000): [RID#136] Process user's groups (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object brian (2026-09-24 14:50:27): [be[example.com]] [sdap_has_deref_support_ex] (0x0400): [RID#136] The server supports deref method OpenLDAP (2026-09-24 14:50:27): [be[example.com]] [sdap_deref_search_send] (0x2000): [RID#136] Server supports OpenLDAP deref (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_search_send] (0x0400): [RID#136] Dereferencing entry [uid=brian,cn=users,cn=accounts,dc=example,dc=com] using OpenLDAP deref (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#136] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_send] (0x0400): [RID#136] WARNING: Disabling paging because scope is set to base. (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#136] ldap_search_ext called: server: [10.75.22.247:389] filter: [(null)] base: [uid=brian,cn=users,cn=accounts,dc=example,dc=com]; msgid = 87 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [posixGroup] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [userPassword] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [gidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaNTSecurityIdentifier] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [modifyTimestamp] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [entryUSN] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaExternalMember] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#136] New operation 87 timeout 6 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edcfdf740], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edcfdf740], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#136] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#136] Handling LDAP operation [87][server: [10.75.22.247:389] filter: [(null)] base: [uid=brian,cn=users,cn=accounts,dc=example,dc=com]] took [11.720] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_parse_entry] (0x0400): [RID#136] Got deref control (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: cn=admins,cn=groups,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: top (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: groupofnames (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: posixgroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipausergroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaobject (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: nestedGroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaNTGroupAttrs (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Found map for objectclass 'posixgroup' (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: objectClass (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: cn (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: admins (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: gidNumber (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 396000000 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: member (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=admin,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=brian,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: ipaUniqueID (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: ee5c762a-3df4-11e5-b75f-0014d11345ac (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: ipaNTSecurityIdentifier (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: S-1-5-21-2174803935-1024707874-457163226-512 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: modifyTimestamp (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 20260703051953Z (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: entryUSN (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 22549839 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: cn=ipausers,cn=groups,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: top (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: groupofnames (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: nestedgroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipausergroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaobject (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Found map for objectclass 'ipausergroup' (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: objectClass (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: cn (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: ipausers (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: member (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=brian,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=alice,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=brianm,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=asterisk,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=dave,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=carrie,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=tanya,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=spamd,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=cyrus,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: ipaUniqueID (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: ee8cbb0a-3df4-11e5-9012-0014d11345ac (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: modifyTimestamp (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 20220117195619Z (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: entryUSN (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 2 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: cn=parents,cn=groups,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: top (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: groupofnames (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: nestedgroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipausergroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaobject (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: posixgroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipantgroupattrs (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Found map for objectclass 'ipausergroup' (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: objectClass (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: cn (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: parents (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: gidNumber (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 396000011 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: member (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=brian,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=alice,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: ipaUniqueID (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: d4101310-9c8d-11ef-8e59-fcaa146c4fd6 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: ipaNTSecurityIdentifier (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: S-1-5-21-2174803935-1024707874-457163226-1011 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: modifyTimestamp (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 20241106222424Z (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: entryUSN (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 8295304 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=35758f4c-059a-11e7-8964-001fc6c4926a,cn=hbac,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipahbacrule (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=2c4b555a-b888-11e6-8f49-0014d11345ac,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=9238e136-5101-11e7-8d91-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=4443c5d8-bd6a-11e7-b453-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=47a505c0-e215-11ea-ae77-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=a9c89108-70bc-11ed-a491-fcaa146c4fd6,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_parse_entry] (0x0400): [RID#136] All deref results from a single control parsed (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edcfdf740], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#136] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#136] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#136] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#136] Operation 87 finished (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object admins (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=admins(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=admins(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object ipausers (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=ipausers(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=ipausers(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object parents (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object admins (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x2000): [RID#136] searching sysdb with filter [(&(objectCategory=group)(member=name=admins(a)example.com,cn=groups,cn=example.com,cn=sysdb)) (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x1000): [RID#136] admins(a)example.com is a member of 0 sysdb groups (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] Looking up direct parents for group [cn=admins,cn=groups,cn=accounts,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] The group [cn=admins,cn=groups,cn=accounts,dc=example,dc=com] has 0 direct parents (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_membership_diff] (0x1000): [RID#136] The group admins(a)example.com is a direct member of 0 LDAP groups (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object ipausers (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x2000): [RID#136] searching sysdb with filter [(&(objectCategory=group)(member=name=ipausers(a)example.com,cn=groups,cn=example.com,cn=sysdb)) (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x1000): [RID#136] ipausers(a)example.com is a member of 0 sysdb groups (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] Looking up direct parents for group [cn=ipausers,cn=groups,cn=accounts,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] The group [cn=ipausers,cn=groups,cn=accounts,dc=example,dc=com] has 0 direct parents (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_membership_diff] (0x1000): [RID#136] The group ipausers(a)example.com is a direct member of 0 LDAP groups (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object parents (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x2000): [RID#136] searching sysdb with filter [(&(objectCategory=group)(member=name=parents(a)example.com,cn=groups,cn=example.com,cn=sysdb)) (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x1000): [RID#136] parents(a)example.com is a member of 0 sysdb groups (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] Looking up direct parents for group [cn=parents,cn=groups,cn=accounts,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] The group [cn=parents,cn=groups,cn=accounts,dc=example,dc=com] has 0 direct parents (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_membership_diff] (0x1000): [RID#136] The group parents(a)example.com is a direct member of 0 LDAP groups (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_store_user_memberships] (0x1000): [RID#136] The user brian(a)example.com is a direct member of 3 LDAP groups (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object admins (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object ipausers (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object parents (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x2000): [RID#136] searching sysdb with filter [(&(objectCategory=group)(member=name=brian(a)example.com,cn=users,cn=example.com,cn=sysdb)) (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=admins(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=ipausers(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x1000): [RID#136] brian(a)example.com is a member of 3 sysdb groups (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_store_user_memberships] (0x2000): [RID#136] Updating memberships for brian(a)example.com (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_done] (0x4000): [RID#136] Initgroups done (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_done] (0x0400): [RID#136] Primary group already cached, nothing to do. (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_done] (0x4000): [RID#136] No need to check for domain local group memberships. (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_destroy] (0x4000): [RID#136] releasing operation connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_done] (0x4000): [RID#136] releasing operation connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_idle] (0x4000): [RID#136] Marking connection as idle (2026-09-24 14:50:27): [be[example.com]] [ipa_id_get_account_info_post_proc_step] (0x0020): [RID#136] Cannot find a UUID. (2026-09-24 14:50:27): [be[example.com]] [ipa_id_get_account_info_orig_done] (0x0040): [RID#136] ipa_id_get_account_info_post_proc_step failed. (2026-09-24 14:50:27): [be[example.com]] [dp_reply_std_set] (0x0080): [RID#136] DP Error is OK on failed request? (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x0400): [RID#136] DP Request [Initgroups #136]: Request handler finished [0]: Success (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x20000): [RID#136] DP Request [Initgroups #136]: Handling request took [25.704] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [_dp_req_recv] (0x0400): [RID#136] DP Request [Initgroups #136]: Receiving request data. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#136] DP Request [Initgroups #136]: Request removed. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#136] Number of active DP request: 0 (2026-09-24 14:50:27): [be[example.com]] [dp_get_account_info_initgroups_resolv_done] (0x0400): [RID#136] Ordering NSS responder to update memory cache (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[(nil)], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list ==> /var/log/sssd/sssd_nss.log <== (2026-09-24 14:50:27): [nss] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [nss] [sbus_method_handler] (0x2000): Received D-Bus method sssd.nss.MemoryCache.UpdateInitgroups on /sssd from sssd.domain_example_2ecom (2026-09-24 14:50:27): [nss] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.domain_example_2ecom] (2026-09-24 14:50:27): [nss] [sss_nss_memorycache_update_initgroups] (0x1000): Updating initgroups memory cache of [brian@example.com@example.com] (2026-09-24 14:50:27): [nss] [sbus_issue_request_done] (0x0400): sssd.nss.MemoryCache.UpdateInitgroups on /sssd from sssd.domain_example_2ecom: Success ==> /var/log/sssd/sssd_example.com.log <== (2026-09-24 14:50:27): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [be[example.com]] [dp_req_reply_std] (0x1000): [RID#136] DP Request [Initgroups #136]: Returning [Success]: 0,22,Success (2026-09-24 14:50:27): [be[example.com]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo on /sssd from sssd.pam: Success (2026-09-24 14:50:27): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.pamHandler on /sssd from sssd.pam (2026-09-24 14:50:27): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.pam] (2026-09-24 14:50:27): [be[example.com]] [dp_pam_handler_send] (0x0100): Got request with the following data (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): domain: example.com (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): user: brian(a)example.com (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): service: sshd (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): tty: ssh (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): ruser: (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): rhost: 2001:123:4567:0:8ce5:e3c5:6b35:d594 (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): authtok type: 0 (No authentication token available) (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available) (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): priv: 1 (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): cli_pid: 943432 (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): child_pid: 0 (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): logon name: not set (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): flags: 0 (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#137] DP Request [PAM Account #137]: REQ_TRACE: New request. [sssd.pam CID #15] Flags [0000]. (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#137] Number of active DP request: 1 (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#137] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sdap_access_send] (0x0400): [RID#137] Performing access check for user [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired_rhds] (0x0400): [RID#137] Performing RHDS access check for user [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired_rhds] (0x4000): [RID#137] Account for user [brian(a)example.com] is not locked. (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired] (0x0400): [RID#137] IPA access control succeeded, checking AD access control (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired_ad] (0x0400): [RID#137] Performing AD access check for user [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired_ad] (0x4000): [RID#137] User account control for user [brian(a)example.com] is [0]. (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired_ad] (0x4000): [RID#137] Expiration time for user [brian(a)example.com] is [0]. (2026-09-24 14:50:27): [be[example.com]] [ipa_fetch_hbac_send] (0x4000): [RID#137] Connection status is [online]. (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#137] reusing cached connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#137] Marking connection as not idle (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#137] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#137] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(objectClass=ipaHost)(|(fqdn=pc.example.com)(serverHostname=pc.example.com)))] base: [cn=accounts,dc=example,dc=com]; msgid = 88 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [fqdn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [serverHostname] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipaSshPubKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#137] New operation 88 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#137] Handling LDAP operation [88][server: [10.75.22.247:389] filter: [(&(objectClass=ipaHost)(|(fqdn=pc.example.com)(serverHostname=pc.example.com)))] base: [cn=accounts,dc=example,dc=com]] took [1.091] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [fqdn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [serverHostname] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipaSshPubKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#137] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#137] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#137] Operation 88 finished (2026-09-24 14:50:27): [be[example.com]] [sdap_has_deref_support_ex] (0x0400): [RID#137] The server supports deref method OpenLDAP (2026-09-24 14:50:27): [be[example.com]] [sdap_deref_search_send] (0x2000): [RID#137] Server supports OpenLDAP deref (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_search_send] (0x0400): [RID#137] Dereferencing entry [fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com] using OpenLDAP deref (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#137] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_send] (0x0400): [RID#137] WARNING: Disabling paging because scope is set to base. (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#137] ldap_search_ext called: server: [10.75.22.247:389] filter: [(null)] base: [fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com]; msgid = 89 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#137] New operation 89 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#137] Handling LDAP operation [89][server: [10.75.22.247:389] filter: [(null)] base: [fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com]] took [8.559] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_parse_entry] (0x0400): [RID#137] Got deref control (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#137] Dereferenced DN: ipaUniqueID=47a505c0-e215-11ea-ae77-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#137] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#137] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_parse_entry] (0x0400): [RID#137] All deref results from a single control parsed (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#137] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#137] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#137] Operation 89 finished (2026-09-24 14:50:27): [be[example.com]] [ipa_hostgroup_info_done] (0x0200): [RID#137] No host groups were dereferenced (2026-09-24 14:50:27): [be[example.com]] [ipa_hbac_service_info_next] (0x0400): [RID#137] Sending request for next search base: [cn=hbac,dc=example,dc=com][2][(objectClass=ipaHBACService)] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#137] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#137] ldap_search_ext called: server: [10.75.22.247:389] filter: [(objectClass=ipaHBACService)] base: [cn=hbac,dc=example,dc=com]; msgid = 90 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#137] New operation 90 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#137] Handling LDAP operation [90][server: [10.75.22.247:389] filter: [(objectClass=ipaHBACService)] base: [cn=hbac,dc=example,dc=com]] took [2.424] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=sshd,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=ftp,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=su,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=login,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=su-l,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=sudo,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=sudo-i,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=gdm,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=gdm-password,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=kdm,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=crond,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=vsftpd,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=pure-ftpd,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=proftpd,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=gssftp,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=imap,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=smtp,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=systemd-user,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=http,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=squid,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=sieve,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#137] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#137] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#137] Operation 90 finished (2026-09-24 14:50:27): [be[example.com]] [ipa_hbac_servicegroup_info_next] (0x0400): [RID#137] Sending request for next search base: [cn=hbac,dc=example,dc=com][2][(objectClass=ipaHBACServiceGroup)] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#137] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#137] ldap_search_ext called: server: [10.75.22.247:389] filter: [(objectClass=ipaHBACServiceGroup)] base: [cn=hbac,dc=example,dc=com]; msgid = 91 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#137] New operation 91 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#137] Handling LDAP operation [91][server: [10.75.22.247:389] filter: [(objectClass=ipaHBACServiceGroup)] base: [cn=hbac,dc=example,dc=com]] took [0.699] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=Sudo,cn=hbacservicegroups,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=ftp,cn=hbacservicegroups,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=gdm-login,cn=hbacservicegroups,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#137] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#137] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#137] Operation 91 finished (2026-09-24 14:50:27): [be[example.com]] [ipa_hbac_rule_info_next] (0x0400): [RID#137] Sending request for next search base: [cn=hbac,dc=example,dc=com][2][(&(objectclass=ipaHBACRule)(ipaenabledflag=TRUE)(accessRuleType=allow)(|(hostCategory=all)(memberHost=fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com)(memberHost=ipaUniqueID=47a505c0-e215-11ea-ae77-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com)))] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#137] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#137] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(objectclass=ipaHBACRule)(ipaenabledflag=TRUE)(accessRuleType=allow)(|(hostCategory=all)(memberHost=fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com)(memberHost=ipaUniqueID=47a505c0-e215-11ea-ae77-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com)))] base: [cn=hbac,dc=example,dc=com]; msgid = 92 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipaenabledflag] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [accessRuleType] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberUser] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [userCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberService] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [serviceCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [sourceHost] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [sourceHostCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [externalHost] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberHost] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [hostCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#137] New operation 92 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede002950], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#137] Handling LDAP operation [92][server: [10.75.22.247:389] filter: [(&(objectclass=ipaHBACRule)(ipaenabledflag=TRUE)(accessRuleType=allow)(|(hostCategory=all)(memberHost=fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com)(memberHost=ipaUniqueID=47a505c0-e215-11ea-ae77-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com)))] base: [cn=hbac,dc=example,dc=com]] took [0.665] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [ipaUniqueID=35758f4c-059a-11e7-8964-001fc6c4926a,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipaenabledflag] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [accessRuleType] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberUser] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [serviceCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [hostCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede002950], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#137] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#137] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#137] Operation 92 finished (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_done] (0x4000): [RID#137] releasing operation connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_idle] (0x4000): [RID#137] Marking connection as idle (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Found [1] items to delete. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=pc.example.com,cn=hbac_hosts,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [pc.example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Found [21] items to delete. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=kdm,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=squid,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=login,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=smtp,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=imap,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=pure-ftpd,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=vsftpd,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=proftpd,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=systemd-user,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=sshd,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=crond,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=sudo,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=su,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=sudo-i,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=gdm,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=ftp,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=gssftp,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=http,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=gdm-password,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=su-l,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=sieve,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [sshd]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [ftp]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [su]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [login]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [su-l]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [sudo]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [sudo-i]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [gdm]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [gdm-password]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [kdm]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [crond]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [vsftpd]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [pure-ftpd]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [proftpd]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [gssftp]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [imap]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [smtp]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [systemd-user]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [http]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [squid]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [sieve]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Found [3] items to delete. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=gdm-login,cn=hbac_servicegroups,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=Sudo,cn=hbac_servicegroups,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=ftp,cn=hbac_servicegroups,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [Sudo]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [ftp]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [gdm-login]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Found [1] items to delete. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=35758f4c-059a-11e7-8964-001fc6c4926a,cn=hbac_rules,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [35758f4c-059a-11e7-8964-001fc6c4926a]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [hbac_attrs_to_rule] (0x1000): [RID#137] Processing rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [hbac_user_attrs_to_rule] (0x1000): [RID#137] Processing users for rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [sysdb_cache_search_users] (0x2000): [RID#137] Search users with filter: (&(objectCategory=user)(originalDN=uid=brian,cn=users,cn=accounts,dc=example,dc=com)) (2026-09-24 14:50:27): [be[example.com]] [hbac_user_attrs_to_rule] (0x2000): [RID#137] Added user [brian(a)example.com] to rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [hbac_service_attrs_to_rule] (0x1000): [RID#137] Processing PAM services for rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [hbac_get_category] (0x0200): [RID#137] Category is set to 'all'. (2026-09-24 14:50:27): [be[example.com]] [hbac_thost_attrs_to_rule] (0x1000): [RID#137] Processing target hosts for rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [hbac_get_category] (0x0200): [RID#137] Category is set to 'all'. (2026-09-24 14:50:27): [be[example.com]] [hbac_shost_attrs_to_rule] (0x0400): [RID#137] Processing source hosts for rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [hbac_shost_attrs_to_rule] (0x2000): [RID#137] Source hosts disabled, setting ALL (2026-09-24 14:50:27): [be[example.com]] [hbac_eval_user_element] (0x1000): [RID#137] [3] groups for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [hbac_eval_user_element] (0x1000): [RID#137] Added group [admins] for user [brian] (2026-09-24 14:50:27): [be[example.com]] [hbac_eval_user_element] (0x1000): [RID#137] Added group [parents] for user [brian] (2026-09-24 14:50:27): [be[example.com]] [hbac_eval_user_element] (0x1000): [RID#137] Added group [ipausers] for user [brian] (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [hbac_evaluate] (0x0100): [RID#137] [< hbac_evaluate() (2026-09-24 14:50:27): [be[example.com]] [hbac_req_debug_print] (0x2000): [RID#137] REQUEST: (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] service [sshd] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] service_group (none) (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] user [brian] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] user_group: (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] [admins] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] [parents] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] [ipausers] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] targethost [pc.example.com] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] targethost_group (none) (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] srchost [2001:123:4567:0:8ce5:e3c5:6b35:d594] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] srchost_group (none) (2026-09-24 14:50:27): [be[example.com]] [hbac_req_debug_print] (0x2000): [RID#137] request time 2026-09-24 14:50:27 (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_debug_print] (0x2000): [RID#137] RULE [brian_all_hosts] [ENABLED]: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_debug_print] (0x2000): [RID#137] services: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] category [0x1] [ALL] (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_debug_print] (0x2000): [RID#137] users: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] category [0] [NONE] (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] users_names: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] [brian] (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] users_groups (none) (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_debug_print] (0x2000): [RID#137] targethosts: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] category [0x1] [ALL] (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_debug_print] (0x2000): [RID#137] srchosts: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] category [0x1] [ALL] (2026-09-24 14:50:27): [be[example.com]] [hbac_evaluate] (0x0100): [RID#137] ALLOWED by rule [brian_all_hosts]. (2026-09-24 14:50:27): [be[example.com]] [hbac_evaluate] (0x0100): [RID#137] hbac_evaluate() >] (2026-09-24 14:50:27): [be[example.com]] [ipa_hbac_evaluate_rules] (0x0080): [RID#137] Access granted by HBAC rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x0400): [RID#137] DP Request [PAM Account #137]: Request handler finished [0]: Success (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x20000): [RID#137] DP Request [PAM Account #137]: Handling request took [57.169] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [_dp_req_recv] (0x0400): [RID#137] DP Request [PAM Account #137]: Receiving request data. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#137] DP Request [PAM Account #137]: Request removed. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#137] Number of active DP request: 0 (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#138] DP Request [PAM SELinux #138]: REQ_TRACE: New request. [sssd.pam CID #15] Flags [0000]. (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#138] Number of active DP request: 1 (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#138] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#138] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [ipa_get_selinux_send] (0x0400): [RID#138] Retrieving SELinux user mapping (2026-09-24 14:50:27): [be[example.com]] [ipa_get_selinux_send] (0x2000): [RID#138] Connection status is [online]. (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#138] reusing cached connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#138] Marking connection as not idle (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#138] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#138] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(cn=ipaConfig)(objectClass=ipaGuiConfig))] base: [cn=etc,dc=example,dc=com]; msgid = 93 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [ipaSELinuxUserMapDefault] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [ipaSELinuxUserMapOrder] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#138] New operation 93 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0002c0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0002c0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#138] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#138] Handling LDAP operation [93][server: [10.75.22.247:389] filter: [(&(cn=ipaConfig)(objectClass=ipaGuiConfig))] base: [cn=etc,dc=example,dc=com]] took [0.737] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#138] OriginalDN: [cn=ipaConfig,cn=etc,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#138] Entry has no attributes [0(Success)]!? (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0002c0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#138] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#138] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#138] Operation 93 finished (2026-09-24 14:50:27): [be[example.com]] [ipa_selinux_get_maps_next] (0x0400): [RID#138] Trying to fetch SELinux maps with following parameters: [2][(&(objectclass=ipaselinuxusermap)(ipaEnabledFlag=TRUE))][cn=selinux,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#138] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#138] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(objectclass=ipaselinuxusermap)(ipaEnabledFlag=TRUE))] base: [cn=selinux,dc=example,dc=com]; msgid = 94 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [memberUser] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [memberHost] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [seeAlso] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [ipaSELinuxUser] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [ipaEnabledFlag] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [userCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [hostCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#138] New operation 94 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0002c0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0002c0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#138] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#138] Handling LDAP operation [94][server: [10.75.22.247:389] filter: [(&(objectclass=ipaselinuxusermap)(ipaEnabledFlag=TRUE))] base: [cn=selinux,dc=example,dc=com]] took [0.329] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#138] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#138] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#138] Operation 94 finished (2026-09-24 14:50:27): [be[example.com]] [ipa_selinux_get_maps_done] (0x0400): [RID#138] No SELinux user maps found! (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_destroy] (0x4000): [RID#138] releasing operation connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_idle] (0x4000): [RID#138] Marking connection as idle (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x0400): [RID#138] DP Request [PAM SELinux #138]: Request handler finished [0]: Success (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x20000): [RID#138] DP Request [PAM SELinux #138]: Handling request took [1.573] mil Is there enough info in there to determine what is going wrong? If not I am (more than!) happy to provide whatever additional information might be necessary. I really need to get this back functional so that I can take another stab at getting off of EL8. Cheers, b.

4 19

Kerberos failover on replica
by Olivier G 15 Oct '26

15 Oct '26

Hi Everyone, We are testing the kerberos failover management of FreeIPA and we were surprised by its behavior with the following topology : two replicas R1, R2 (configured as replicas of each others) and one client C1 (configured with the two replicas). We execute the command 'kinit admin' on one of the server as described: Configuration : R1, R2 running Command works on C1, R1 and R2 Configuration : R1 stopped, R2 running Command works on C1 (it try to contact R1 and R2 as a failover thanks to the DNS) but fails on R1 (which is unexpected). We tried to configure static configuration with multitple kdc and kdc_master in the /etc/krb5.conf file but it does work. Moreover remote login on R1 thanks to SSSD has the same behavior : it does not try R2 failover (the ticket cache works if there is any) and the login fails. Is it an expected behavior ? Are we missing something ? Thanks for reading Olivier IPA version : 4.11.0

2 1

Trust between FreeIPA and Keycloak
by Francis Augusto Medeiros-Logeay 08 Oct '26

08 Oct '26

Hi, I developed a Keycloak extension (Keycloak PSSO extension) so that users of managed macOS machines get SSO. The framework used - Platform Single Sign-on - also allows returning kerberos tickets. But I'm not sure how Keycloak could programmatically return kerberos tickets for a user without the password. Some of the pPlatform SSO flows do not involve using passwords. The idea I had first was to use my extension with some keytab with permissions to request kerberos tickets on behalf of other users. But has FreeIPA support for OAuth2 tokens, so that I could simply exchange an OAuth2 token to a kerberos tickets? This would be easier since I already control token issuing on the keycloak side. Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 10

DB locks issue
by Orion Poplawski 07 Oct '26

07 Oct '26

Periodically recently we've been seeing our IPA 389 servers complain about running out of locks. Had another spate last night: [05/Oct/2026:23:59:01.213763242 -0600] - NOTICE - bdb_compact - Compacting DB start: userRoot [05/Oct/2026:23:59:01.230473177 -0600] - NOTICE - bdb_do_compact - Compacting databases ... [05/Oct/2026:23:59:01.232221019 -0600] - NOTICE - bdb_do_compact - Compacting DB: userRoot [05/Oct/2026:23:59:01.298726798 -0600] - NOTICE - bdb_db_compact_one_db - compactdb: compact userRoot - 6 pages freed [05/Oct/2026:23:59:01.317889617 -0600] - NOTICE - bdb_do_compact - Compacting Replication Changelog: userRoot [05/Oct/2026:23:59:36.485232209 -0600] - CRIT - ldbm_back_next_search_entry - DB locks threshold is reached (nsslapd-db-locks-monitoring-threshold under cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config). Please, increase nsslapd-db-locks according to your needs. [05/Oct/2026:23:59:36.521600710 -0600] - CRIT - ldbm_back_next_search_entry - DB locks threshold is reached (nsslapd-db-locks-monitoring-threshold under cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config). Please, increase nsslapd-db-locks according to your needs. [05/Oct/2026:23:59:36.525528105 -0600] - ERR - ids_sasl_check_bind - sasl bind failed mech=GSSAPI (conn=98639): SASL(-14): authorization failure: [05/Oct/2026:23:59:37.253791042 -0600] - ERR - libdb - BDB2055 Lock table is out of available lock entries ... LOTS OF THESE ... [06/Oct/2026:00:02:21.091563310 -0600] - CRIT - ldbm_back_next_search_entry - DB locks threshold is reached (nsslapd-db-locks -monitoring-threshold under cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config). Please, increase nsslapd-db-locks accord ing to your needs. [06/Oct/2026:00:02:21.093369230 -0600] - CRIT - ldbm_back_next_search_entry - DB locks threshold is reached (nsslapd-db-locks-monitoring-threshold under cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config). Please, increase nsslapd-db-locks according to your needs. [06/Oct/2026:00:02:21.213832955 -0600] - NOTICE - bdb_db_compact_one_db - compactdb: compact ipaca - 0 pages freed [06/Oct/2026:00:02:21.215728292 -0600] - NOTICE - bdb_do_compact - Compacting Replication Changelog: ipaca [06/Oct/2026:00:02:21.232152622 -0600] - NOTICE - bdb_db_compact_one_db - compactdb: compact ipaca - 0 pages freed [06/Oct/2026:00:02:21.234640647 -0600] - NOTICE - bdb_do_compact - Compacting DB: changelog [06/Oct/2026:00:02:21.236521659 -0600] - NOTICE - bdb_db_compact_one_db - compactdb: compact changelog - 0 pages freed [06/Oct/2026:00:02:21.237943094 -0600] - NOTICE - bdb_do_compact - Compacting Replication Changelog: changelog [06/Oct/2026:00:02:21.239425345 -0600] - NOTICE - bdb_do_compact - Compacting databases finished. [06/Oct/2026:00:02:21.320132067 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:24.400447933 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:27.477384978 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:29.551874750 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:32.638543912 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:35.718848659 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:38.799295444 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:41.885263951 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:44.969278524 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:45.899692476 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-bld02.cora.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:48.047058127 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:02:51.120265022 -0600] - ERR - NSMMReplicationPlugin - check_replica_auth - Invalid binddn krbprincipalname=ldap/ipa-mry01.mry.nwra.com(a)nwra.com,cn=services,cn=accounts,dc=nwra,dc=com to perform replication extended operation [06/Oct/2026:00:59:37.359032617 -0600] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=ipa-bld01.cora.nwra.com-to-ipa-sea01.nwra.com" (ipa-sea01:389) - Replication bind with GSSAPI auth failed: LDAP error 49 (Invalid credentials) () [06/Oct/2026:01:00:00.894556979 -0600] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=ipa-bld01.cora.nwra.com-to-ipa-sea01.nwra.com" (ipa-sea01:389) - Replication bind with GSSAPI auth failed: LDAP error 49 (Invalid credentials) () [06/Oct/2026:01:01:10.504556658 -0600] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=ipa-bld01.cora.nwra.com-to-ipa-sea01.nwra.com" (ipa-sea01:389): Replication bind with GSSAPI auth resumed [06/Oct/2026:01:01:10.648779773 -0600] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=ipa-bld01.cora.nwra.com-to-ipa-sea01.nwra.com" (ipa-sea01:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [06/Oct/2026:01:02:46.634739364 -0600] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=ipa-bld01.cora.nwra.com-to-ipa-sea01.nwra.com" (ipa-sea01:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [06/Oct/2026:01:03:10.354185538 -0600] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=ipa-bld01.cora.nwra.com-to-ipa-sea01.nwra.com" (ipa-sea01:389): Replication bind with GSSAPI auth resumed [06/Oct/2026:01:03:10.493468730 -0600] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=ipa-bld01.cora.nwra.com-to-ipa-sea01.nwra.com" (ipa-sea01:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. Lock table maximum is 150000. 389-ds-base-2.8.0-10.el9_8.x86_64 Any idea what is causing this or how to prevent it? -- Orion Poplawski he/him/his - surely the least important thing about me Manager of IT Systems 720-772-5637 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 4

Rocky 10 passkey_child issue.
by ian willis 02 Oct '26

02 Oct '26

Hi, FYI for anyone using FreeIPA with FIDO2/passkey authentication on RHEL/Rocky 10.2. I realise this is probably outside the scope of what FreeIPA itself supports on the client side, but since many FreeIPA MFA/passkey deployments will be using SSSD and the IPA SELinux policy, this seemed like a useful place to flag it. After upgrading the FreeIPA client packages from 4.13.1 to 4.13.4, FIDO2/passkey login stopped working. The failure produces an SELinux denial: avc: denied { execute } for comm="sssd_pam" name="passkey_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file The apparent change is in: ipa-selinux-4.13.4-1.el10_2 With the previous working version: ipa-selinux-4.13.1-3.el10_2.2 `/usr/libexec/sssd/passkey_child` is labelled: system_u:object_r:ipa_otpd_exec_t:s0 With 4.13.4 it is instead labelled: system_u:object_r:sssd_mfa_exec_t:s0 The new policy defines `sssd_mfa_t`, but on these clients there is no usable transition from `sssd_t` to `sssd_mfa_t`, so `sssd_pam` is denied when attempting to execute `passkey_child`. Downgrading only `ipa-selinux` restores passkey login: sudo dnf downgrade ipa-selinux-4.13.1-3.el10_2.2 Tested with: sssd-2.12.0-3.el10_2.1 sssd-passkey-2.12.0-3.el10_2.1 selinux-policy-42.1.18-4.el10_2.3 selinux-policy-targeted-42.1.18-4.el10_2.3 So this looks like a policy mismatch introduced by the newer `ipa-selinux` package rather than an IPA enrolment problem. Posting mainly as a heads-up in case anyone else sees FIDO2/passkey authentication suddenly stop working after updating the FreeIPA client packages. Regards, Ian

3 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2026