Problems with enumerate=true

[Trent Johnson]

Hi,

After upgrading from rhel6.3 to the 6.4 sssd-1.9.2-82.7.el6_4.x86_64 we can no longer use
enumerate=true with active directory and rfc2307bis.  

Upon starting the service, sssd_be consumes 100% of the cpu and getent takes a long time
to return results.  In the logs we see:

/var/log/messages sssd[be[TESTWIN]]: dereference processing failed : Input/output error
/var/log/sssd/sssd.log [sssd] [mt_svc_sigkill] (0x0010): [TESTWIN][10702] is not
responding to SIGTERM. Sending SIGKILL.

Thanks,
Trent

[Lukas Slebodnik]

On (23/05/13 07:28), Trent Johnson wrote:
> Hi,
>
> After upgrading from rhel6.3 to the 6.4 sssd-1.9.2-82.7.el6_4.x86_64 we can no longer use
> enumerate=true with active directory and rfc2307bis.  
>
> Upon starting the service, sssd_be consumes 100% of the cpu and getent takes a long time
> to return results.  In the logs we see:
>
> /var/log/messages sssd[be[TESTWIN]]: dereference processing failed : Input/output error
> /var/log/sssd/sssd.log [sssd] [mt_svc_sigkill] (0x0010): [TESTWIN][10702] is not
> responding to SIGTERM. Sending SIGKILL.
>
> Thanks,
> Trent
>  
It is not possible to say, where is the problem from two lines of log.
One enumeration bug was fixed in rhel6.4.

Do you think, that (https://bugzilla.redhat.com/show_bug.cgi?id=953165) is the
same problem as you have?

LS

[Trent Johnson]

On May 23, 2013, at 8:02 AM, Lukas Slebodnik <lslebodn(a)redhat.com&gt; wrote:

>  On (23/05/13 07:28), Trent Johnson wrote:
> > Hi,
> > 
> > After upgrading from rhel6.3 to the 6.4 sssd-1.9.2-82.7.el6_4.x86_64 we can no longer
> use enumerate=true with active directory and rfc2307bis.  
> > 
> > Upon starting the service, sssd_be consumes 100% of the cpu and getent takes a long
> time to return results.  In the logs we see:
> > 
> > /var/log/messages sssd[be[TESTWIN]]: dereference processing failed : Input/output
> error
> > /var/log/sssd/sssd.log [sssd] [mt_svc_sigkill] (0x0010): [TESTWIN][10702] is not
> responding to SIGTERM. Sending SIGKILL.
> > 
> > Thanks,
> > Trent
> > 
>  It is not possible to say, where is the problem from two lines of log.
>  One enumeration bug was fixed in rhel6.4.
>  
>  Do you think, that (https://bugzilla.redhat.com/show_bug.cgi?id=953165) is the
>  same problem as you have?
>  
>  LS
>   
I am not authorized to view that bug.  The above was the only thing in the logs.  I can
turn on debug and send you the logs off list if you like.

Thanks,
Trent

[Jakub Hrozek]

On Thu, May 23, 2013 at 08:44:52AM -0500, Trent Johnson wrote:
>  
>  On May 23, 2013, at 8:02 AM, Lukas Slebodnik <lslebodn(a)redhat.com&gt; wrote:
>  
>  > On (23/05/13 07:28), Trent Johnson wrote:
>  >> Hi,
>  >> 
>  >> After upgrading from rhel6.3 to the 6.4 sssd-1.9.2-82.7.el6_4.x86_64 we can no
> longer use enumerate=true with active directory and rfc2307bis.  
>  >> 
>  >> Upon starting the service, sssd_be consumes 100% of the cpu and getent takes a
> long time to return results.  In the logs we see:
>  >> 
>  >> /var/log/messages sssd[be[TESTWIN]]: dereference processing failed :
> Input/output error
>  >> /var/log/sssd/sssd.log [sssd] [mt_svc_sigkill] (0x0010): [TESTWIN][10702] is not
> responding to SIGTERM. Sending SIGKILL.
>  >> 
>  >> Thanks,
>  >> Trent
>  >> 
>  > It is not possible to say, where is the problem from two lines of log.
>  > One enumeration bug was fixed in rhel6.4.
>  > 
>  > Do you think, that (https://bugzilla.redhat.com/show_bug.cgi?id=953165) is the
>  > same problem as you have?
>  > 
>  > LS
>  > 
>  
>  I am not authorized to view that bug.  
I'm sorry Trent, that bug contains some confidential customer
information and was marked as private. The corresponding upstream ticket
is https://fedorahosted.org/sssd/ticket/1893

>  The above was the only thing in the logs.  I can turn on debug and
> send you the logs off list if you like.
>  
>  Thanks,
>  Trent 
If I built you a test package, would you be able to test it? The problem
was not really easy to spot from the logs.

[Trent Johnson]

On 05/23/2013 09:48 AM, Jakub Hrozek wrote:
>  On Thu, May 23, 2013 at 08:44:52AM -0500, Trent Johnson wrote:
> >
> > On May 23, 2013, at 8:02 AM, Lukas Slebodnik <lslebodn(a)redhat.com&gt; wrote:
> >
> >> On (23/05/13 07:28), Trent Johnson wrote:
> >>> Hi,
> >>>
> >>> After upgrading from rhel6.3 to the 6.4 sssd-1.9.2-82.7.el6_4.x86_64 we can
> no longer use enumerate=true with active directory and rfc2307bis.
> >>>
> >>> Upon starting the service, sssd_be consumes 100% of the cpu and getent takes
> a long time to return results.  In the logs we see:
> >>>
> >>> /var/log/messages sssd[be[TESTWIN]]: dereference processing failed :
> Input/output error
> >>> /var/log/sssd/sssd.log [sssd] [mt_svc_sigkill] (0x0010): [TESTWIN][10702] is
> not responding to SIGTERM. Sending SIGKILL.
> >>>
> >>> Thanks,
> >>> Trent
> >>>
> >> It is not possible to say, where is the problem from two lines of log.
> >> One enumeration bug was fixed in rhel6.4.
> >>
> >> Do you think, that (https://bugzilla.redhat.com/show_bug.cgi?id=953165) is the
> >> same problem as you have?
> >>
> >> LS
> >>
> >
> > I am not authorized to view that bug.
>
>  I'm sorry Trent, that bug contains some confidential customer
>  information and was marked as private. The corresponding upstream ticket
>  is https://fedorahosted.org/sssd/ticket/1893
>
> > The above was the only thing in the logs.  I can turn on debug and send you the logs
> off list if you like.
> >
> > Thanks,
> > Trent
>
>  If I built you a test package, would you be able to test it? The problem
>  was not really easy to spot from the logs. 
Yes, I would be happy to try out a test package.

Thanks,
Trent

[Jakub Hrozek]

On Thu, May 23, 2013 at 04:48:20PM +0200, Jakub Hrozek wrote:
>  On Thu, May 23, 2013 at 08:44:52AM -0500, Trent Johnson wrote:
>  > 
>  > On May 23, 2013, at 8:02 AM, Lukas Slebodnik <lslebodn(a)redhat.com&gt; wrote:
>  > 
>  > > On (23/05/13 07:28), Trent Johnson wrote:
>  > >> Hi,
>  > >> 
>  > >> After upgrading from rhel6.3 to the 6.4 sssd-1.9.2-82.7.el6_4.x86_64 we can
> no longer use enumerate=true with active directory and rfc2307bis.  
>  > >> 
>  > >> Upon starting the service, sssd_be consumes 100% of the cpu and getent
> takes a long time to return results.  In the logs we see:
>  > >> 
>  > >> /var/log/messages sssd[be[TESTWIN]]: dereference processing failed :
> Input/output error
>  > >> /var/log/sssd/sssd.log [sssd] [mt_svc_sigkill] (0x0010): [TESTWIN][10702]
> is not responding to SIGTERM. Sending SIGKILL.
>  > >> 
>  > >> Thanks,
>  > >> Trent
>  > >> 
>  > > It is not possible to say, where is the problem from two lines of log.
>  > > One enumeration bug was fixed in rhel6.4.
>  > > 
>  > > Do you think, that (https://bugzilla.redhat.com/show_bug.cgi?id=953165) is the
>  > > same problem as you have?
>  > > 
>  > > LS
>  > > 
>  > 
>  > I am not authorized to view that bug. 
>  
>  I'm sorry Trent, that bug contains some confidential customer
>  information and was marked as private. The corresponding upstream ticket
>  is https://fedorahosted.org/sssd/ticket/1893
>  
>  > The above was the only thing in the logs.  I can turn on debug and send you the logs
> off list if you like.
>  > 
>  > Thanks,
>  > Trent
>  
>  If I built you a test package, would you be able to test it? The problem
>  was not really easy to spot from the logs. 
This might actually be hitting more people, so I built the test packages
and put them into my fedorapeople space:

http://jhrozek.fedorapeople.org/sssd-enum-bug/

[steve]

On Thu, 2013-05-23 at 17:42 +0200, Jakub Hrozek wrote:
>  On Thu, May 23, 2013 at 04:48:20PM +0200, Jakub Hrozek wrote:
>  > On Thu, May 23, 2013 at 08:44:52AM -0500, Trent Johnson wrote:
>  > > 
>  > > On May 23, 2013, at 8:02 AM, Lukas Slebodnik <lslebodn(a)redhat.com&gt;
> wrote:
>  > > 
>  > > > On (23/05/13 07:28), Trent Johnson wrote:
>  > > >> Hi,
>  > > >> 
>  > > >> After upgrading from rhel6.3 to the 6.4 sssd-1.9.2-82.7.el6_4.x86_64
> we can no longer use enumerate=true with active directory and rfc2307bis.  
>  > > >>  
Hi
We use AD but with ad. Should we be using rfc2307bis?
openSUSE 12.3 with sssd 1.10.0beta1
Confused.

[Jakub Hrozek]

On Thu, May 23, 2013 at 05:53:09PM +0200, steve wrote:
>  On Thu, 2013-05-23 at 17:42 +0200, Jakub Hrozek wrote:
>  > On Thu, May 23, 2013 at 04:48:20PM +0200, Jakub Hrozek wrote:
>  > > On Thu, May 23, 2013 at 08:44:52AM -0500, Trent Johnson wrote:
>  > > > 
>  > > > On May 23, 2013, at 8:02 AM, Lukas Slebodnik <lslebodn(a)redhat.com&gt;
> wrote:
>  > > > 
>  > > > > On (23/05/13 07:28), Trent Johnson wrote:
>  > > > >> Hi,
>  > > > >> 
>  > > > >> After upgrading from rhel6.3 to the 6.4
> sssd-1.9.2-82.7.el6_4.x86_64 we can no longer use enumerate=true with active directory and
> rfc2307bis.  
>  > > > >> 
>  
>  Hi
>  We use AD but with ad. Should we be using rfc2307bis?
>  openSUSE 12.3 with sssd 1.10.0beta1
>  Confused. 
ldap_schema = rfc2307bis or ldap_schema = ad

The latter is new in 6.4, so many existing deployments are running with
rfc2307bis and a couple of attribute mappings. The AD schema removes the
need for the mappings (and is the default schema in the AD provider).

[Trent Johnson]

On 05/23/2013 10:42 AM, Jakub Hrozek wrote:
>  On Thu, May 23, 2013 at 04:48:20PM +0200, Jakub Hrozek wrote:
> > On Thu, May 23, 2013 at 08:44:52AM -0500, Trent Johnson wrote:
> >>
> >> On May 23, 2013, at 8:02 AM, Lukas Slebodnik <lslebodn(a)redhat.com&gt; wrote:
> >>
> >>> On (23/05/13 07:28), Trent Johnson wrote:
> >>>> Hi,
> >>>>
> >>>> After upgrading from rhel6.3 to the 6.4 sssd-1.9.2-82.7.el6_4.x86_64 we
> can no longer use enumerate=true with active directory and rfc2307bis.
> >>>>
> >>>> Upon starting the service, sssd_be consumes 100% of the cpu and getent
> takes a long time to return results.  In the logs we see:
> >>>>
> >>>> /var/log/messages sssd[be[TESTWIN]]: dereference processing failed :
> Input/output error
> >>>> /var/log/sssd/sssd.log [sssd] [mt_svc_sigkill] (0x0010): [TESTWIN][10702]
> is not responding to SIGTERM. Sending SIGKILL.
> >>>>
> >>>> Thanks,
> >>>> Trent
> >>>>
> >>> It is not possible to say, where is the problem from two lines of log.
> >>> One enumeration bug was fixed in rhel6.4.
> >>>
> >>> Do you think, that (https://bugzilla.redhat.com/show_bug.cgi?id=953165) is
> the
> >>> same problem as you have?
> >>>
> >>> LS
> >>>
> >>
> >> I am not authorized to view that bug.
> >
> > I'm sorry Trent, that bug contains some confidential customer
> > information and was marked as private. The corresponding upstream ticket
> > is https://fedorahosted.org/sssd/ticket/1893
> >
> >> The above was the only thing in the logs.  I can turn on debug and send you the
> logs off list if you like.
> >>
> >> Thanks,
> >> Trent
> >
> > If I built you a test package, would you be able to test it? The problem
> > was not really easy to spot from the logs.
>
>  This might actually be hitting more people, so I built the test packages
>  and put them into my fedorapeople space:
>
>  http://jhrozek.fedorapeople.org/sssd-enum-bug/ 
Thank you.  I have tested this, and it is working well.  Will this be 
ported into rhel, or should I open a bug there?

Thanks,
Trent

[Jakub Hrozek]

On Thu, May 23, 2013 at 01:02:34PM -0500, Trent Johnson wrote:
>  
>  On 05/23/2013 10:42 AM, Jakub Hrozek wrote:
>  >On Thu, May 23, 2013 at 04:48:20PM +0200, Jakub Hrozek wrote:
>  >>On Thu, May 23, 2013 at 08:44:52AM -0500, Trent Johnson wrote:
>  >>>
>  >>>On May 23, 2013, at 8:02 AM, Lukas Slebodnik <lslebodn(a)redhat.com&gt;
> wrote:
>  >>>
>  >>>>On (23/05/13 07:28), Trent Johnson wrote:
>  >>>>>Hi,
>  >>>>>
>  >>>>>After upgrading from rhel6.3 to the 6.4 sssd-1.9.2-82.7.el6_4.x86_64
> we can no longer use enumerate=true with active directory and rfc2307bis.
>  >>>>>
>  >>>>>Upon starting the service, sssd_be consumes 100% of the cpu and
> getent takes a long time to return results.  In the logs we see:
>  >>>>>
>  >>>>>/var/log/messages sssd[be[TESTWIN]]: dereference processing failed :
> Input/output error
>  >>>>>/var/log/sssd/sssd.log [sssd] [mt_svc_sigkill] (0x0010):
> [TESTWIN][10702] is not responding to SIGTERM. Sending SIGKILL.
>  >>>>>
>  >>>>>Thanks,
>  >>>>>Trent
>  >>>>>
>  >>>>It is not possible to say, where is the problem from two lines of log.
>  >>>>One enumeration bug was fixed in rhel6.4.
>  >>>>
>  >>>>Do you think, that (https://bugzilla.redhat.com/show_bug.cgi?id=953165)
> is the
>  >>>>same problem as you have?
>  >>>>
>  >>>>LS
>  >>>>
>  >>>
>  >>>I am not authorized to view that bug.
>  >>
>  >>I'm sorry Trent, that bug contains some confidential customer
>  >>information and was marked as private. The corresponding upstream ticket
>  >>is https://fedorahosted.org/sssd/ticket/1893
>  >>
>  >>>The above was the only thing in the logs.  I can turn on debug and send you
> the logs off list if you like.
>  >>>
>  >>>Thanks,
>  >>>Trent
>  >>
>  >>If I built you a test package, would you be able to test it? The problem
>  >>was not really easy to spot from the logs.
>  >
>  >This might actually be hitting more people, so I built the test packages
>  >and put them into my fedorapeople space:
>  >
>  >http://jhrozek.fedorapeople.org/sssd-enum-bug/
>  
>  Thank you.  I have tested this, and it is working well. 
Great, thank you for testing!

>  Will this be ported
>  into rhel, or should I open a bug there? 
Currently it is planned for 6.5. The other customer who hit this issue
was OK with a private build similar to the one I gave you.

If you need these packages released sooner, then I'd suggest to escalate
the bug with yout Red Hat support representative.