Unable to find 'admin' user with 'getent passwd [e-mail]'!

[Damola Azeez]

Hello,

I tried enrolling an Ubuntu 20.04 Server to IPA. At the end of the installation, i get the
bellow message


Unable to find 'admin' user with 'getent passwd admin(a)domain.com'!
Unable to reliably detect configuration. Check NSS setup manually.


While attempting to troubleshoot, i tried running "getent passwd admin" but
nothing was returned.
sssd service is running


● sssd.service - System Security Services Daemon
     Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2023-02-21 17:17:40 UTC; 26min ago
   Main PID: 1108213 (sssd)
      Tasks: 7 (limit: 9439)
     Memory: 41.9M
     CGroup: /system.slice/sssd.service
             ├─1108213 /usr/sbin/sssd -i --logger=files
             ├─1108235 /usr/libexec/sssd/sssd_be --domain domain.com --uid 0 --gid 0
--logger=files
             ├─1108241 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
             ├─1108242 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files
             ├─1108243 /usr/libexec/sssd/sssd_ssh --uid 0 --gid 0 --logger=files
             ├─1108244 /usr/libexec/sssd/sssd_sudo --uid 0 --gid 0 --logger=files
             └─1108245 /usr/libexec/sssd/sssd_pac --uid 0 --gid 0 --logger=files

Feb 21 17:17:40 softpayv4prodapp.domain.com sssd_pac[1108245]: Starting up
Feb 21 17:17:40 softpayv4prodapp.domain.com systemd[1]: Started System Security Services
Daemon.
Feb 21 17:17:40 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
Feb 21 17:17:40 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
Feb 21 17:17:40 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
Feb 21 17:17:40 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 2
Feb 21 17:32:50 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
Feb 21 17:32:50 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
Feb 21 17:32:50 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
Feb 21 17:32:50 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 2


Any help where the issue may be?

[Rob Crittenden]

Damola Azeez via FreeIPA-users wrote:
>  Hello,
>  
>  I tried enrolling an Ubuntu 20.04 Server to IPA. At the end of the installation, i get
> the bellow message
>  
>  
>  Unable to find 'admin' user with 'getent passwd admin(a)domain.com'!
>  Unable to reliably detect configuration. Check NSS setup manually.
>  
>  
>  While attempting to troubleshoot, i tried running "getent passwd admin" but
> nothing was returned.
>  sssd service is running
>  
>  
>  ● sssd.service - System Security Services Daemon
>       Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled)
>       Active: active (running) since Tue 2023-02-21 17:17:40 UTC; 26min ago
>     Main PID: 1108213 (sssd)
>        Tasks: 7 (limit: 9439)
>       Memory: 41.9M
>       CGroup: /system.slice/sssd.service
>               ├─1108213 /usr/sbin/sssd -i --logger=files
>               ├─1108235 /usr/libexec/sssd/sssd_be --domain domain.com --uid 0 --gid 0
> --logger=files
>               ├─1108241 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
>               ├─1108242 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files
>               ├─1108243 /usr/libexec/sssd/sssd_ssh --uid 0 --gid 0 --logger=files
>               ├─1108244 /usr/libexec/sssd/sssd_sudo --uid 0 --gid 0 --logger=files
>               └─1108245 /usr/libexec/sssd/sssd_pac --uid 0 --gid 0 --logger=files
>  
>  Feb 21 17:17:40 softpayv4prodapp.domain.com sssd_pac[1108245]: Starting up
>  Feb 21 17:17:40 softpayv4prodapp.domain.com systemd[1]: Started System Security Services
> Daemon.
>  Feb 21 17:17:40 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
>  Feb 21 17:17:40 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
>  Feb 21 17:17:40 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
>  Feb 21 17:17:40 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 2
>  Feb 21 17:32:50 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
>  Feb 21 17:32:50 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
>  Feb 21 17:32:50 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 1
>  Feb 21 17:32:50 softpayv4prodapp.domain.com sssd_be[1108235]: GSSAPI client step 2
>   
I'd suggest starting with https://sssd.io/troubleshooting/basics.html .

rob

[Damola Azeez]

Hi Rob,
I've followed the  troubleshooting guide you shared and here is what i saw in the
debug logs of sssd_<domain>.log

(Wed Feb 22 11:00:41 2023) [be[domain.com]] [check_failed_login_attempts] (0x4000): Failed
login attempts [0], allowed failed login attempts [0], failed login delay [5].
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [sysdb_cache_auth] (0x0100): Cached
credentials not available.
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [ldb] (0x4000): cancel ldb transaction
(nesting: 0)
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [krb5_auth_cache_creds] (0x0020): Offline
authentication failed
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [check_wait_queue] (0x1000): Wait queue for
user [daazeez(a)domain.com] is empty.
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [krb5_auth_queue_done] (0x1000):
krb5_auth_queue request [0x55dad4968120] done.
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [dp_req_done] (0x0400): DP Request [PAM
Authenticate #6]: Request handler finished [0]: Success
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [_dp_req_recv] (0x0400): DP Request [PAM
Authenticate #6]: Receiving request data.
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [dp_req_destructor] (0x0400): DP Request [PAM
Authenticate #6]: Request removed.
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [dp_req_destructor] (0x0400): Number of active
DP request: 0
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [sbus_issue_request_done] (0x0400):
sssd.dataprovider.pamHandler: Success
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [child_sig_handler] (0x1000): Waiting for
child [1117943].
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [child_sig_handler] (0x0100): child [1117943]
finished successfully.
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [sbus_dispatch] (0x4000): Dispatching.
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [remove_krb5_info_files] (0x0200): Could not
remove [/var/lib/sss/pubconf/kpasswdinfo.DOMAIN.COM], [2][No such file or directory]
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [be_ptask_offline_cb] (0x0400): Back end is
offline
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [be_ptask_disable] (0x0400): Task [Subdomains
Refresh]: disabling task
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [be_ptask_offline_cb] (0x0400): Back end is
offline
(Wed Feb 22 11:00:41 2023) [be[domain.com]] [be_ptask_disable] (0x0400): Task [SUDO Smart
Refresh]: disabling task
(Wed Feb 22 11:00:42 2023) [be[domain.com]] [be_ptask_offline_cb] (0x0400): Back end is
offline
(Wed Feb 22 11:00:42 2023) [be[domain.com]] [be_ptask_disable] (0x0400): Task [SUDO Full
Refresh]: disabling task
(Wed Feb 22 11:00:42 2023) [be[domain.com]] [sdap_id_release_conn_data] (0x4000):
releasing unused connection
(Wed Feb 22 11:00:42 2023) [be[domain.com]] [sdap_handle_release] (0x2000): Trace:
sh[0x55dad494b900], connected[1], ops[(nil)], ldap[0x55dad49466e0], destructor_lock[0],
release_memory[0]
(Wed Feb 22 11:00:42 2023) [be[domain.com]] [remove_connection_callback] (0x4000):
Successfully removed connection callback.

[Damola Azeez]

Here is the full sssd_domain.log file content,

https://pastebin.com/aQaMs8VW

[Rob Crittenden]

Damola Azeez via FreeIPA-users wrote:
>  Here is the full sssd_domain.log file content,
>  
>  https://pastebin.com/aQaMs8VW 
Probably this, DNS lookup fails.

(Wed Feb 22 11:32:34 2023) [be[domain.com]] [resolv_discover_srv_done]
(0x0040): SRV query failed [12]: Timeout while contacting DNS servers
(Wed Feb 22 11:32:34 2023) [be[domain.com]] [fo_set_port_status]
(0x0100): Marking port 0 of server '(no name)' as 'not working'
(Wed Feb 22 11:32:34 2023) [be[domain.com]] [resolve_srv_done] (0x0040):
Unable to resolve SRV [1432158238]: SRV lookup error
(Wed Feb 22 11:32:34 2023) [be[domain.com]] [set_srv_data_status]
(0x0100): Marking SRV lookup of service 'IPA' as 'not resolved'
(Wed Feb 22 11:32:34 2023) [be[domain.com]] [be_resolve_server_process]
(0x0080): Couldn't resolve server (SRV lookup meta-server), resolver
returned [1432158238]: SRV lookup error

rob