Hi Devs,
I am seeing an issue with sssd-1.8.0-32.el6.x86_64
Issue description. When system is on a different VLAN as the Active directory servers logins are really slow or timeout and I see these errors.
I see this in the syslog Aug 13 10:27:32 m4deploy01 sssd_be: GSSAPI Error: An invalid name was supplied (Unknown error)
I see this in the sssd log (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_parse_entry] (0x4000): OriginalDN: [CN=Derek Page,OU=Concord,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com] with fd [35]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com] with fd [36]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com] with fd [37]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [37]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [36]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [35]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Mon Aug 13 10:30:09 2012) [sssd[be[my.domain.com]]] [sbus_dispatch] (0x4000): dbus conn: 2163580
If I moved the system to the same VLAN as the Active Directory servers and these errors go away and everything works great.
Other systems running sssd-1.5.1-49.el5_8.1 on a different VLAN then my Active Directory servers also work great. Is this an issue with 1.8.0-32?
Any suggestions?
Here are my configs.
#/etc/krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log
[libdefaults] default_realm = MYDOMAIN.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true default_tgs_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 default_tkt_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 permitted_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
[realms] MY.DOMAIN.COM = { kdc = ad.my.domain.com:88 admin_server = ad.my.domain.com default_domain = my.domain.com }
[domain_realm] .my.domain.com = MY.DOMAIN.COM my.domain.com = MY.DOMAIN.COM
#/etc/sssd/sssd.conf [domain/default]
cache_credentials = fasle [sssd] config_file_version = 2 domains = my.domain.com
reconnection_retries = 3
sbus_timeout = 30 services = nss, pam
[nss] filter_groups = root filter_users = root reconnection_retries = 3
[pam] reconnection_retries = 3
[domain/my.domain.com] cache_credentials = false enumerate = false min_id = 80 max_id = 30000 id_provider = ldap auth_provider = krb5 ldap_uri = ldap://ad3.my.domain.com/ ldap_schema = rfc2307bis ldap_user_search_base = dc=my,dc=domain,dc=com ldap_user_object_class = person ldap_user_modify_timestamp = whenChanged ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_user_principal = userPrincipalName ldap_group_search_base = dc=my,dc=domain,dc=com ldap_group_object_class = group ldap_group_modify_timestamp = whenChanged ldap_group_nesting_level = 5 ldap_account_expire_policy = ad ldap_sasl_authid = M4DEPLOY01$@MY.DOMAIN.COM ldap_krb5_init_creds = true ldap_pwd_policy = mit_kerberos chpass_provider = krb5 ldap_sasl_mech = GSSAPI krb5_realm = MY.DOMAIN.COM krb5_validate = true ldap_user_name = sAMAccountName ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_user_principal = userPrincipalName ldap_group_object_class = group ldap_group_name = sAMAccountName ldap_group_gid_number = gidNumber ldap_force_upper_case_realm = true #ldap_referrals = false
# User Group and Account Access access_provider = simple #simple_allow_users = simple_allow_groups = m4_login
debug_level = 10
On Mon, 2012-08-13 at 10:46 -0400, Derek Page wrote:
Hi Devs,
I am seeing an issue with sssd-1.8.0-32.el6.x86_64
Issue description. When system is on a different VLAN as the Active directory servers logins are really slow or timeout and I see these errors.
I see this in the syslog Aug 13 10:27:32 m4deploy01 sssd_be: GSSAPI Error: An invalid name was supplied (Unknown error)
From this log, it looks like you're getting referrals to Active Directory servers that don't support GSSAPI binds (or don't support allowing them from your particular host). As a workaround right now, I'd strongly recommend setting 'ldap_referrals = False' on Active Directory environments. AD mistreats referrals pretty badly and it results in poor performance all-around.
I notice you have ldap_referrals = false present but commented-out. Could that be the difference between your RHEL 5 and RHEL 6 environments?
I see this in the sssd log (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_parse_entry] (0x4000): OriginalDN: [CN=Derek Page,OU=Concord,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com] with fd [35]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com] with fd [36]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com] with fd [37]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [37]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [36]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [35]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Mon Aug 13 10:30:09 2012) [sssd[be[my.domain.com]]] [sbus_dispatch] (0x4000): dbus conn: 2163580
If I moved the system to the same VLAN as the Active Directory servers and these errors go away and everything works great.
Other systems running sssd-1.5.1-49.el5_8.1 on a different VLAN then my Active Directory servers also work great. Is this an issue with 1.8.0-32?
Any suggestions?
Here are my configs.
#/etc/krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log
[libdefaults] default_realm = MYDOMAIN.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true default_tgs_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 default_tkt_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 permitted_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
[realms] MY.DOMAIN.COM = { kdc = ad.my.domain.com:88 admin_server = ad.my.domain.com default_domain = my.domain.com }
[domain_realm] .my.domain.com = MY.DOMAIN.COM my.domain.com = MY.DOMAIN.COM
#/etc/sssd/sssd.conf [domain/default]
cache_credentials = fasle [sssd] config_file_version = 2 domains = my.domain.com
reconnection_retries = 3
sbus_timeout = 30 services = nss, pam
[nss] filter_groups = root filter_users = root reconnection_retries = 3
[pam] reconnection_retries = 3
[domain/my.domain.com] cache_credentials = false enumerate = false min_id = 80 max_id = 30000 id_provider = ldap auth_provider = krb5 ldap_uri = ldap://ad3.my.domain.com/ ldap_schema = rfc2307bis ldap_user_search_base = dc=my,dc=domain,dc=com ldap_user_object_class = person ldap_user_modify_timestamp = whenChanged ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_user_principal = userPrincipalName ldap_group_search_base = dc=my,dc=domain,dc=com ldap_group_object_class = group ldap_group_modify_timestamp = whenChanged ldap_group_nesting_level = 5 ldap_account_expire_policy = ad ldap_sasl_authid = M4DEPLOY01$@MY.DOMAIN.COM ldap_krb5_init_creds = true ldap_pwd_policy = mit_kerberos chpass_provider = krb5 ldap_sasl_mech = GSSAPI krb5_realm = MY.DOMAIN.COM krb5_validate = true ldap_user_name = sAMAccountName ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_user_principal = userPrincipalName ldap_group_object_class = group ldap_group_name = sAMAccountName ldap_group_gid_number = gidNumber ldap_force_upper_case_realm = true #ldap_referrals = false
# User Group and Account Access access_provider = simple #simple_allow_users = simple_allow_groups = m4_login
debug_level = 10 _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Thanks,
That did the trick.
I did not have this defined in either my 1.5 or 1.8 instances? Not sure why 1.8 acts differently. This fixed my issues for 1.8 not being able to authenticate as well as sped up authentication for my 1.5.
On Mon, Aug 13, 2012 at 10:52 AM, Stephen Gallagher sgallagh@redhat.com wrote:
On Mon, 2012-08-13 at 10:46 -0400, Derek Page wrote:
Hi Devs,
I am seeing an issue with sssd-1.8.0-32.el6.x86_64
Issue description. When system is on a different VLAN as the Active directory servers logins are really slow or timeout and I see these errors.
I see this in the syslog Aug 13 10:27:32 m4deploy01 sssd_be: GSSAPI Error: An invalid name was supplied (Unknown error)
From this log, it looks like you're getting referrals to Active Directory servers that don't support GSSAPI binds (or don't support allowing them from your particular host). As a workaround right now, I'd strongly recommend setting 'ldap_referrals = False' on Active Directory environments. AD mistreats referrals pretty badly and it results in poor performance all-around.
I notice you have ldap_referrals = false present but commented-out. Could that be the difference between your RHEL 5 and RHEL 6 environments?
I see this in the sssd log (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_parse_entry] (0x4000): OriginalDN: [CN=Derek Page,OU=Concord,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com] with fd [35]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com] with fd [36]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com] with fd [37]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://my.domain.com/CN=Configuration,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [37]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://ForestDnsZones.my.domain.com/DC=ForestDnsZones,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [36]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://DomainDnsZones.my.domain.com/DC=DomainDnsZones,DC=my,DC=domain,DC=com]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [35]. (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x21a99c0], connected[1], ops[0x2194c10], ldap[0x31ae7b0] (Mon Aug 13 10:30:06 2012) [sssd[be[my.domain.com]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Mon Aug 13 10:30:09 2012) [sssd[be[my.domain.com]]] [sbus_dispatch] (0x4000): dbus conn: 2163580
If I moved the system to the same VLAN as the Active Directory servers and these errors go away and everything works great.
Other systems running sssd-1.5.1-49.el5_8.1 on a different VLAN then my Active Directory servers also work great. Is this an issue with 1.8.0-32?
Any suggestions?
Here are my configs.
#/etc/krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log
[libdefaults] default_realm = MYDOMAIN.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true default_tgs_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 default_tkt_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 permitted_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
[realms] MY.DOMAIN.COM = { kdc = ad.my.domain.com:88 admin_server = ad.my.domain.com default_domain = my.domain.com }
[domain_realm] .my.domain.com = MY.DOMAIN.COM my.domain.com = MY.DOMAIN.COM
#/etc/sssd/sssd.conf [domain/default]
cache_credentials = fasle [sssd] config_file_version = 2 domains = my.domain.com
reconnection_retries = 3
sbus_timeout = 30 services = nss, pam
[nss] filter_groups = root filter_users = root reconnection_retries = 3
[pam] reconnection_retries = 3
[domain/my.domain.com] cache_credentials = false enumerate = false min_id = 80 max_id = 30000 id_provider = ldap auth_provider = krb5 ldap_uri = ldap://ad3.my.domain.com/ ldap_schema = rfc2307bis ldap_user_search_base = dc=my,dc=domain,dc=com ldap_user_object_class = person ldap_user_modify_timestamp = whenChanged ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_user_principal = userPrincipalName ldap_group_search_base = dc=my,dc=domain,dc=com ldap_group_object_class = group ldap_group_modify_timestamp = whenChanged ldap_group_nesting_level = 5 ldap_account_expire_policy = ad ldap_sasl_authid = M4DEPLOY01$@MY.DOMAIN.COM ldap_krb5_init_creds = true ldap_pwd_policy = mit_kerberos chpass_provider = krb5 ldap_sasl_mech = GSSAPI krb5_realm = MY.DOMAIN.COM krb5_validate = true ldap_user_name = sAMAccountName ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_user_principal = userPrincipalName ldap_group_object_class = group ldap_group_name = sAMAccountName ldap_group_gid_number = gidNumber ldap_force_upper_case_realm = true #ldap_referrals = false
# User Group and Account Access access_provider = simple #simple_allow_users = simple_allow_groups = m4_login
debug_level = 10 _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
On Mon, Aug 13, 2012 at 10:46:43AM -0400, Derek Page wrote:
Hi Devs,
I am seeing an issue with sssd-1.8.0-32.el6.x86_64
Issue description. When system is on a different VLAN as the Active directory servers logins are really slow or timeout and I see these errors.
I see this in the syslog Aug 13 10:27:32 m4deploy01 sssd_be: GSSAPI Error: An invalid name was supplied (Unknown error)
Why is ldap_referrals = false commented out in the config file? I would expect that disabling referrals would help in your case (and it's recommended with AD in general)
sssd-devel@lists.fedorahosted.org
-
Derek Page -
Jakub Hrozek -
Stephen Gallagher