4:29 a.m.
Hi!
I didn't found mailing list on which I could discuss user
(configuration) issues, so I'm sending the comments/questions here.
For the past two or so weeks I tried to configure SSSD on F-12 and RHEL6
beta (and also on Ubuntu 9.10) using authconfig and editing
configuration files without any success and it drives me crazy!
Moreover, the information on the Internet is very scarce, and debug
options are quite limited (at least as far as I know). I'm using FreeIPA
server on another Fedora which, I believe, works, because, configuring
individually LDAP, Kerberos and nss/pam everyting is fine. But, using
SSSD, it doesn't work.
As a side note, when I configured SSSD using authconfig I had to
manually configure /etc/krb5.conf in order to be able to use kinit. I
don't know if it is intentional or not, but if I configure kerberos
parameters in SSSD section of authconfig, wouldn't it be reasonable that
all the related configuration files are also updated?
Next, trying to obtain list of users from the server by issuing the
following command:
getent -s sss group
I get nothing. Looking into debug log of sssd, I found the following
lines which could be related:
(Thu May 6 11:21:09 2010) [sssd[nss]] [nss_cmd_setgrent_ext] (4):
Requesting info for all groups
(Thu May 6 11:21:09 2010) [sssd[nss]] [sss_dp_send_acct_req_create]
(4): Sending request for [ASBIPA][4098][1][name=*]
(Thu May 6 11:21:09 2010) [sssd[nss]] [sss_dp_get_reply] (4): Got reply
(1, 11, Fast reply - offline) from Data Provider
(Thu May 6 11:21:09 2010) [sssd[nss]] [nss_cmd_setgr_dp_callback] (2):
Unable to get information from Data Provider
Error: 1, 11, Fast reply - offline
Will try to return what we have in cache
(Thu May 6 11:21:09 2010) [sssd[nss]] [nss_cmd_getgrent] (4):
Requesting info for all groups
(Thu May 6 11:21:09 2010) [sssd[nss]] [nss_cmd_endgrent] (4):
Terminating request info for all groups
(Thu May 6 11:21:09 2010) [sssd[nss]] [client_recv] (5): Client
disconnected!
(Thu May 6 11:21:11 2010) [sssd] [monitor_quit] (0): Interrupt: killing
children
Note that the log is full of the following lines:
(Thu May 6 11:20:27 2010) [sssd] [service_check_alive] (4): Checking
service ASBIPA(11208) is still alive
(Thu May 6 11:20:27 2010) [sssd] [service_send_ping] (4): Pinging
ASBIPA
(Thu May 6 11:20:27 2010) [sssd] [service_check_alive] (4): Checking
service nss(11209) is still alive
(Thu May 6 11:20:27 2010) [sssd] [service_send_ping] (4): Pinging nss
(Thu May 6 11:20:27 2010) [sssd] [service_check_alive] (4): Checking
service pam(11210) is still alive
(Thu May 6 11:20:27 2010) [sssd] [service_send_ping] (4): Pinging pam
(Thu May 6 11:20:27 2010) [sssd] [ping_check] (4): Service ASBIPA
replied to ping
(Thu May 6 11:20:27 2010) [sssd] [ping_check] (4): Service nss replied
to ping
(Thu May 6 11:20:27 2010) [sssd] [ping_check] (4): Service pam replied
to ping
Which, I assume, indicate that everything is OK?
I used tcpdump to see if anything accesses the LDAP port on IPA server
and there is no single try to access LDAP!
What confuses me is the question how to debug local issues. Obviously
it's a local problem, but what are my options in debugging those?
The configuration file (/etc/sssd/sssd.conf) is at the end of this mail.
Stjepan Gros
Configuration file (very slightly edited to remove sensitive
information):
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = ASBIPA
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
offline_credentials_expiration = 2
reconnection_retries = 3
[domain/ASBIPA]
use_fully_qualified_names = False
cache_credentials = True
auth_provider = ipa
access_provider = ipa
debug_level = 0
store_legacy_passwords = False
enumerate = True
ldap_user_search_base = dc=freeipa,dc=local
krb5_realm = FREEIPA.LOCAL
chpass_provider = ipa
id_provider = ipa
ipa_hostname = fedora.freeipa.local
min_id = 1000
ipa_server = 10.0.9.200