[Bug 2466974] New: SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Bug ID: 2466974
           Summary: SSSD 2.13 doesn't work in offline mode, generates
                    plenty of Permission denied errors
           Product: Fedora
           Version: 44
          Hardware: x86_64
                OS: Linux
            Status: NEW
         Component: sssd
          Keywords: Regression
          Severity: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
        QA Contact: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]
  Target Milestone: ---
    Classification: Fedora

After upgrading Fedora 43 to 44 windows domain accounts linked via freeipa
stopped working in offline mode. Also confirmed that installing fc43 packages
of sssd (v.2.12) to fc44 restores normal work. And upgrading them back to fc44
(v.2.13) restores the problem.
Logs are full of:

(2026-05-06 11:54:57): [ssh] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#7] CR #6: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:57): [ssh] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#8] CR #7: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:57): [nss] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#16] CR #140: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:55:00): [nss] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#16] CR #141: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:38): [pam] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#3] CR #7: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:57): [pam] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#4] CR #11: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:06): [sudo] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#1] CR #0: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:06): [sudo] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#1] CR #1: Data Provider Error: 3, 13, Permission denied
[ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server:
[13](Permission denied)
[ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to
LDAP [13]: Permission denied
[ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains
[13]: Permission denied

Disabling selinux doesn't change anything.
If access_provider=permit - same result and errors.
If sssd goes online - everything works ok, no errors. 
Cleaning cache - no effect.
I compared file/forder permissions (/etc/sssd, /var/lib/sss) on fc43 (v2.12)
and fc44 (v.2.13) - didn't find any difference.

Reproducible: Always

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Dmitry  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Comment|0                           |updated

--- Comment #0 has been edited ---

After upgrading Fedora 43 to 44 windows domain accounts linked via freeipa
stopped working in offline mode. Also confirmed that installing fc43 packages
of sssd (v.2.12) to fc44 restores normal work. And upgrading them back to fc44
(v.2.13) restores the problem.
Logs are full of:

(2026-05-06 11:54:57): [ssh] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#7] CR #6: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:57): [ssh] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#8] CR #7: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:57): [nss] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#16] CR #140: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:55:00): [nss] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#16] CR #141: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:38): [pam] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#3] CR #7: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:57): [pam] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#4] CR #11: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:06): [sudo] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#1] CR #0: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:06): [sudo] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#1] CR #1: Data Provider Error: 3, 13, Permission denied
[ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server:
[13](Permission denied)
[ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to
LDAP [13]: Permission denied
[ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains
[13]: Permission denied

Disabling selinux doesn't change anything.
If access_provider=permit - same result and errors.
If sssd goes online - everything works ok, no errors. 
Cleaning cache - no effect.
I compared file/forder permissions (/etc/sssd, /var/lib/sss) on fc43 (v2.12)
and fc44 (v.2.13) - didn't find any difference.
Checked also on a fresh fc44 installation - same result, if 2.13 - permission
denied errors

Reproducible: Always

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?([e-mail]
                   |                            |m)

--- Comment #1 from Alexey Tikhonov  ---
Hi,

(In reply to Dmitry from comment #0)
> [ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied)
> [ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied
> [ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied

Could you please clear /var/log/sssd/*, reproduce an issue and attach sanitized
/var/log/sssd/sssd_$domain.log?

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

--- Comment #2 from Alexey Tikhonov  ---
> > [ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied)
> > [ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied
> > [ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied

Probably it's
https://github.com/SSSD/sssd/blob/master/src/providers/ldap/sdap_async_conne...
and change introduced by
https://github.com/SSSD/sssd/commit/cc42932ac4c58c681d4d928b53f2803bbb9ad277

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Dmitry  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?([e-mail] |
                   |m)                          |

--- Comment #3 from Dmitry  ---
debug_level = 5

sssd_domain.log:
(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for
[0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#140] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0100):
[RID#140] Resetting the status of port 0 for server '(no name)'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_send] (0x0200):
[RID#140] The status of SRV lookup is neutral
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_getsrv_send] (0x0100):
[RID#140] Trying to resolve SRV record of '_ldap._tcp.ipa.domain.com'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_discover_srv_done]
(0x0040): [RID#140] SRV query failed [4]: Domain name not found
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [check_wait_queue] (0x1000):
[RID#139] Wait queue for user [[e-mail]] is empty.
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [krb5_auth_queue_done]
(0x1000): [RID#139] krb5_auth_queue request [0x55b6e5652ec0] done.
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [dp_req_done] (0x0400):
[RID#139] DP Request [PAM Authenticate #139]: Request handler finished [0]:
Success
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [_dp_req_recv] (0x0400):
[RID#139] DP Request [PAM Authenticate #139]: Receiving request data.
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [dp_req_destructor] (0x0400):
[RID#139] DP Request [PAM Authenticate #139]: Request removed.
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [dp_req_destructor] (0x0400):
[RID#139] Number of active DP request: 0
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [sbus_issue_request_done]
(0x0400): sssd.dataprovider.pamHandler on /sssd from sssd.pam: Success
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [child_sig_handler] (0x1000):
[RID#139] Waiting for child [4953].
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [child_sig_handler] (0x0100):
[RID#139] child [4953] finished successfully.
   *  (2026-05-06 12:58:37): [be[ipa.domain.com]] [be_subdom_reset_status]
(0x1000): [RID#137] Resetting subdomain ad.domain.com
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sbus_dispatch] (0x4000):
Dispatching.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sbus_method_handler]
(0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd from
sssd.nss
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sbus_senders_lookup]
(0x2000): Looking for identity of sender [sssd.nss]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for
[0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_attach_req] (0x0400):
[RID#140] DP Request [Account #140]: REQ_TRACE: New request. [sssd.nss CID #20]
Flags [0x0001].
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_attach_req] (0x0400):
[RID#140] Number of active DP request: 1
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_id_op_connect_step]
(0x4000): [RID#140] beginning to connect
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_kinit_send] (0x0400):
[RID#140] Attempting kinit (default, host/aduser1.vm.ipa.domain.com,
ipa.domain.com, 86400)
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_kinit_next_kdc]
(0x1000): [RID#140] Resolving next KDC for service IPA
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send]
(0x0100): [RID#140] Trying to resolve service 'IPA'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x1000):
[RID#140] Port status of port 0 for server '(no name)' is 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#140] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0100):
[RID#140] Resetting the status of port 0 for server '(no name)'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]]
[fo_resolve_service_activate_timeout] (0x2000): [RID#140] Resolve timeout
[dns_resolver_timeout] set to 6 seconds
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_srv_data_status]
(0x0400): [RID#140] Changing state of SRV lookup from 'SRV_RESOLVE_ERROR' to
'SRV_NEUTRAL'.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_send] (0x0200):
[RID#140] The status of SRV lookup is neutral
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]]
[resolv_discover_srv_next_domain] (0x0400): [RID#140] SRV resolution of service
'ldap'. Will use DNS discovery domain 'ipa.domain.com'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_getsrv_send]
(0x0100): [RID#140] Trying to resolve SRV record of '_ldap._tcp.ipa.domain.com'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_request_timeout]
(0x2000): [RID#140] Scheduling a timeout of 3 seconds
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_timeout_watcher]
(0x2000): [RID#140] Scheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [unschedule_timeout_watcher]
(0x4000): [RID#140] Unscheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [request_watch_destructor]
(0x0400): [RID#140] Deleting request watch
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_discover_srv_done]
(0x0040): [RID#140] SRV query failed [4]: Domain name not found
********************** BACKTRACE DUMP ENDS HERE
*********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_set_port_status] (0x0100):
[RID#140] Marking port 0 of server '(no name)' as 'not working'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_done] (0x0040):
[RID#140] Unable to resolve SRV [1432158237]: SRV record not found
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_set_port_status]
(0x0100): [RID#140] Marking port 0 of server '(no name)' as 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_done] (0x0040):
[RID#140] Unable to resolve SRV [1432158237]: SRV record not found
********************** BACKTRACE DUMP ENDS HERE
*********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [set_srv_data_status] (0x0100):
[RID#140] Marking SRV lookup of service 'IPA' as 'not resolved'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process]
(0x0080): [RID#140] Couldn't resolve server (SRV lookup meta-server), resolver
returned [1432158237]: SRV record not found
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x0100):
[RID#140] Resetting the server status of 'node4.ipa.domain.com'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_files_send]
(0x0100): [RID#140] Trying to resolve A record of 'node4.ipa.domain.com' in
files
(2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status]
(0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'resolving name'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_files_send]
(0x0100): [RID#140] Trying to resolve AAAA record of 'node4.ipa.domain.com' in
files
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next]
(0x0200): [RID#140] No more address families to retry
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_dns_query]
(0x0100): [RID#140] Trying to resolve A record of 'node4.ipa.domain.com' in DNS
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_dns_query]
(0x0100): [RID#140] Trying to resolve AAAA record of 'node4.ipa.domain.com' in
DNS
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next]
(0x0200): [RID#140] No more address families to retry
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next]
(0x0100): [RID#140] No more hosts databases to retry
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_done] (0x0020):
[RID#140] Failed to resolve server 'node4.ipa.domain.com': Domain name not
found
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_srv_data_status]
(0x0100): [RID#140] Marking SRV lookup of service 'IPA' as 'not resolved'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process]
(0x0080): [RID#140] Couldn't resolve server (SRV lookup meta-server), resolver
returned [1432158237]: SRV record not found
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process]
(0x1000): [RID#140] Trying with the next one!
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send]
(0x0100): [RID#140] Trying to resolve service 'IPA'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000):
[RID#140] Status of server 'node4.ipa.domain.com' is 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x0100):
[RID#140] Resetting the server status of 'node4.ipa.domain.com'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x1000):
[RID#140] Port status of port 0 for server 'node4.ipa.domain.com' is 'neutral'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]]
[fo_resolve_service_activate_timeout] (0x2000): [RID#140] Resolve timeout
[dns_resolver_timeout] set to 6 seconds
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000):
[RID#140] Status of server 'node4.ipa.domain.com' is 'name not resolved'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_is_unix] (0x4000):
[RID#140] [node4.ipa.domain.com] does not look like a unix domain socket
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_is_address] (0x4000):
[RID#140] [node4.ipa.domain.com] does not look like an IP address
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step]
(0x2000): [RID#140] Querying files
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]]
[resolv_gethostbyname_files_send] (0x0100): [RID#140] Trying to resolve A
record of 'node4.ipa.domain.com' in files
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status]
(0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'resolving name'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step]
(0x2000): [RID#140] Querying files
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]]
[resolv_gethostbyname_files_send] (0x0100): [RID#140] Trying to resolve AAAA
record of 'node4.ipa.domain.com' in files
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next]
(0x0200): [RID#140] No more address families to retry
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step]
(0x2000): [RID#140] Querying DNS
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]]
[resolv_gethostbyname_dns_query] (0x0100): [RID#140] Trying to resolve A record
of 'node4.ipa.domain.com' in DNS
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_request_timeout]
(0x2000): [RID#140] Scheduling a timeout of 3 seconds
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_timeout_watcher]
(0x2000): [RID#140] Scheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [unschedule_timeout_watcher]
(0x4000): [RID#140] Unscheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [request_watch_destructor]
(0x0400): [RID#140] Deleting request watch
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step]
(0x2000): [RID#140] Querying DNS
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]]
[resolv_gethostbyname_dns_query] (0x0100): [RID#140] Trying to resolve AAAA
record of 'node4.ipa.domain.com' in DNS
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_request_timeout]
(0x2000): [RID#140] Scheduling a timeout of 3 seconds
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_timeout_watcher]
(0x2000): [RID#140] Scheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [unschedule_timeout_watcher]
(0x4000): [RID#140] Unscheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [request_watch_destructor]
(0x0400): [RID#140] Deleting request watch
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next]
(0x0200): [RID#140] No more address families to retry
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next]
(0x0100): [RID#140] No more hosts databases to retry
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_done]
(0x0020): [RID#140] Failed to resolve server 'node4.ipa.domain.com': Domain
name not found
********************** BACKTRACE DUMP ENDS HERE
*********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status]
(0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'not working'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process]
(0x0080): [RID#140] Couldn't resolve server (node4.ipa.domain.com), resolver
returned [11]: Resource temporarily unavailable
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#140] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#140] No available servers for service 'IPA'
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status]
(0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process]
(0x0080): [RID#140] Couldn't resolve server (node4.ipa.domain.com), resolver
returned [11]: Resource temporarily unavailable
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process]
(0x1000): [RID#140] Trying with the next one!
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send]
(0x0100): [RID#140] Trying to resolve service 'IPA'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000):
[RID#140] Status of server 'node4.ipa.domain.com' is 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x1000):
[RID#140] Port status of port 0 for server '(no name)' is 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#140] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000):
[RID#140] Status of server 'node4.ipa.domain.com' is 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send]
(0x0020): [RID#140] No available servers for service 'IPA'
********************** BACKTRACE DUMP ENDS HERE
*********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#140] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#140] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#140] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#140] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#140] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#140] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected]
(0x0040): [RID#140] sdap_id_op_connect request failed.
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_id_release_conn_data]
(0x4000): [RID#140] Releasing unused connection with fd [-1]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_done]
(0x1000): [RID#140] Server [NULL] resolution failed: [5]: Input/output error
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]]
[sdap_cli_resolve_and_connect_kinit_done] (0x0400): [RID#140] Cannot get a TGT:
ret [1432158230](Network I/O Error)
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_id_op_connect_done]
(0x4000): [RID#140] notify error to op #1: 13 [Permission denied]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]]
[ipa_subdomain_account_connected] (0x0040): [RID#140] sdap_id_op_connect
request failed.
********************** BACKTRACE DUMP ENDS HERE
*********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for
[0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#141] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#141] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#141] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#141] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#141] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#141] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#141] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#141] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#141] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#141] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#141] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#141] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected]
(0x0040): [RID#141] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=[e-mail]]
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#142] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#142] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#142] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#142] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#142] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#142] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#142] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#142] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#142] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#142] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#142] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#142] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected]
(0x0040): [RID#142] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got
request with the following data
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): command:
SSS_PAM_PREAUTH
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain:
ad.domain.com
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): user:
[e-mail]
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): service:
plasmalogin
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok
type: 0 (No authentication token available)
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100):
newauthtok type: 0 (No authentication token available)
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid:
4975
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100):
child_pid: 0
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon
name: not set
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#143] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#143] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#143] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [child_sig_handler] (0x0100):
[RID#143] child [4976] finished successfully.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=[e-mail]]
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#144] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#144] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#144] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#144] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#144] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#144] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#144] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#144] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#144] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#144] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#144] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#144] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected]
(0x0040): [RID#144] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got
request with the following data
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): command:
SSS_PAM_AUTHENTICATE
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain:
ad.domain.com
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): user:
[e-mail]
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): service:
plasmalogin
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok
type: 1 (Password)
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100):
newauthtok type: 0 (No authentication token available)
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid:
4975
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100):
child_pid: 0
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon
name: not set
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#145] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#145] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#145] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200):
[RID#145] Entry [name=[e-mail],cn=users,cn=ad.domain.com,cn=sysdb]
has set [ts_cache] attrs.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_cache_auth] (0x0100):
[RID#145] Authentication failed.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200):
[RID#145] Entry [name=[e-mail],cn=users,cn=ad.domain.com,cn=sysdb]
has set [cache, ts_cache] attrs.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [krb5_auth_cache_creds] (0x0020):
[RID#145] Offline authentication failed
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_done]
(0x1000): [RID#145] Server [NULL] resolution failed: [5]: Input/output error
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_mark_dom_offline]
(0x1000): [RID#145] Marking subdomain ad.domain.com offline
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_mark_subdom_offline]
(0x4000): [RID#145] Subdomain already inactive
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sss_child_handler_setup]
(0x2000): [RID#145] Setting up signal handler up for pid [4977]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sss_child_handler_setup]
(0x2000): [RID#145] Signal handler set up for pid [4977]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [_write_pipe_handler]
(0x0400): [RID#145] All data has been sent!
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [_read_pipe_handler]
(0x4000): [RID#145] Adding [53] bytes of data.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [_read_pipe_handler]
(0x0400): [RID#145] All data received
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [parse_krb5_child_response]
(0x1000): [RID#145] child response: status code: 0 (Success), msg type: 3 (Env
variable to be set with pam_putenv(3)), len: 41
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [krb5_mod_ccname] (0x4000):
[RID#145] Save ccname [KEYRING:persistent:1346422211] for user
[[e-mail]].
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr]
(0x0200): [RID#145] Entry
[name=[e-mail],cn=users,cn=ad.domain.com,cn=sysdb] has set
[ts_cache] attrs.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [merge_msg_ts_attrs]
(0x2000): [RID#145] No such DN in the timestamp cache:
name=[e-mail],cn=users,cn=ad.domain.com,cn=sysdb
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_merge_res_ts_attrs]
(0x2000): [RID#145] TS cache doesn't contain this DN, skipping
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [merge_msg_ts_attrs]
(0x2000): [RID#145] No such DN in the timestamp cache:
name=[e-mail],cn=users,cn=ad.domain.com,cn=sysdb
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_merge_res_ts_attrs]
(0x2000): [RID#145] TS cache doesn't contain this DN, skipping
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_cache_auth] (0x4000):
[RID#145] Offline credentials expiration is [0] days.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [check_failed_login_attempts]
(0x4000): [RID#145] Failed login attempts [1], allowed failed login attempts
[0], failed login delay [5].
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]]
[check_for_combined_2fa_password] (0x1000): [RID#145] Wrong authtok type.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_cache_auth] (0x0100):
[RID#145] Authentication failed.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_ldb_msg_difference]
(0x2000): [RID#145] Replaced/extended attr [lastFailedLogin] of entry
[name=[e-mail],cn=users,cn=ad.domain.com,cn=sysdb]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr]
(0x0200): [RID#145] Entry
[name=[e-mail],cn=users,cn=ad.domain.com,cn=sysdb] has set [cache,
ts_cache] attrs.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [krb5_auth_cache_creds]
(0x0020): [RID#145] Offline authentication failed
********************** BACKTRACE DUMP ENDS HERE
*********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [child_sig_handler] (0x0100):
[RID#145] child [4977] finished successfully.

sssd_pam/nss.log:
(2026-05-06 12:59:01): [pam] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#6] CR #21: Data Provider Error: 3, 13, Permission denied
(2026-05-06 12:59:01): [pam] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#6] CR #23: Data Provider Error: 3, 13, Permission denied

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

--- Comment #4 from Alexey Tikhonov  ---
(In reply to Alexey Tikhonov from comment #2)
> > > [ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied)
> > > [ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied
> > > [ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied
>
> Probably it's
> https://github.com/SSSD/sssd/blob/master/src/providers/ldap/
> sdap_async_connection.c#L2208

That's it:
```
[sdap_cli_resolve_and_connect_kinit_done] (0x0400): [RID#140] Cannot get a TGT:
ret [1432158230](Network I/O Error)
[sdap_id_op_connect_done] (0x4000): [RID#140] notify error to op #1: 13
[Permission denied]
```

Yet I'm not fully understand:
```
[check_for_combined_2fa_password] (0x1000): [RID#145] Wrong authtok type.
[sysdb_cache_auth] (0x0100): [RID#145] Authentication failed.
[krb5_auth_cache_creds] (0x0020): [RID#145] Offline authentication failed
```

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?([e-mail]
                   |                            |m)

--- Comment #5 from Alexey Tikhonov  ---
(In reply to Alexey Tikhonov from comment #4)
> [check_for_combined_2fa_password] (0x1000): [RID#145] Wrong authtok type.
> [sysdb_cache_auth] (0x0100): [RID#145] Authentication failed.
> [krb5_auth_cache_creds] (0x0020): [RID#145] Offline authentication failed

Did you enter correct password during this test?

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Dmitry  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?([e-mail] |
                   |m)                          |

--- Comment #6 from Dmitry  ---
Sorry, my bad, tried several times, no difference in login process to verify
the password.
New logs below:

sssd_domain.log
  *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for
[0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#249] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#249] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#249] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#249] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#249] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#249] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#249] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#249] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#249] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#249] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#249] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#249] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected]
(0x0040): [RID#249] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for
[0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#250] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#250] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#250] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#250] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#250] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#250] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#250] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#250] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#250] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#250] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#250] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#250] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected]
(0x0040): [RID#250] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=[e-mail]]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#251] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#251] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#251] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#251] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#251] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#251] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#251] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#251] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#251] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#251] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#251] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#251] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected]
(0x0040): [RID#251] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got
request with the following data
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): command:
SSS_PAM_PREAUTH
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain:
ad.domain.com
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): user:
[e-mail]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): service:
plasmalogin
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok
type: 0 (No authentication token available)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100):
newauthtok type: 0 (No authentication token available)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid:
5224
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100):
child_pid: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon
name: not set
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#252] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#252] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#252] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [child_sig_handler] (0x0100):
[RID#252] child [5225] finished successfully.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=[e-mail]]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#253] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#253] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#253] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#253] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#253] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#253] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#253] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#253] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#253] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#253] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#253] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#253] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected]
(0x0040): [RID#253] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got
request with the following data
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): command:
SSS_PAM_AUTHENTICATE
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain:
ad.domain.com
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): user:
[e-mail]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): service:
plasmalogin
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok
type: 1 (Password)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100):
newauthtok type: 0 (No authentication token available)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid:
5224
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100):
child_pid: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon
name: not set
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#254] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#254] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#254] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200):
[RID#254] Entry [name=[e-mail],cn=users,cn=ad.domain.com,cn=sysdb]
has set [ts_cache] attrs.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [sysdb_cache_auth] (0x0100):
[RID#254] Hashes do match!
(2026-05-06 13:36:41): [be[ipa.domain.com]] [child_sig_handler] (0x0100):
[RID#254] child [5226] finished successfully.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for
[0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#255] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#255] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#255] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#255] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#255] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#255] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#255] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#255] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#255] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#255] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#255] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#255] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected]
(0x0040): [RID#255] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send]
(0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=[e-mail]]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#256] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#256] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#256] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#256] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#256] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#256] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#256] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#256] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#256] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#256] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#256] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#256] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected]
(0x0040): [RID#256] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got
request with the following data
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): command:
SSS_PAM_ACCT_MGMT
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain:
ad.domain.com
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): user:
[e-mail]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): service:
plasmalogin
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok
type: 0 (No authentication token available)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100):
newauthtok type: 0 (No authentication token available)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid:
5224
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100):
child_pid: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon
name: not set
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_access_obtain_filter_lists]
(0x0200): [RID#257] Deny users list is empty.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [sss_parse_name] (0x0200):
[RID#257] Domain not provided!
(2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_access_obtain_filter_lists]
(0x0200): [RID#257] Deny groups list is empty.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_access_check_send]
(0x0200): [RID#257] Simple access check for [e-mail]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_check_get_groups_primary]
(0x0200): [RID#257] Could not look up primary group [1346422211]: [2][No such
file or directory]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#258] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#258] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#258] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#258] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#258] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#258] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#258] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#258] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#258] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100):
[RID#258] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080):
[RID#258] SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020):
[RID#258] No available servers for service 'IPA'

sssd_nss/pam.log
(2026-05-06 13:36:41): [pam] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#10] CR #41: Data Provider Error: 3, 13, Permission denied
(2026-05-06 13:36:41): [pam] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#10] CR #43: Data Provider Error: 3, 13, Permission denied
(2026-05-06 13:36:41): [pam] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#10] CR #45: Data Provider Error: 3, 13, Permission denied

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

--- Comment #7 from Alexey Tikhonov  ---
Thank you for the logs.
> [simple_access_check_send] (0x0200): [RID#257] Simple access check for [e-mail]
> [simple_check_get_groups_primary] (0x0200): [RID#257] Could not look up primary group [1346422211]: [2][No such file or directory]

This looks like the consequence of the same bug as mentioned in comment 2

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|[e-mail] |[e-mail]
                   |raproject.org               |

--- Comment #8 from Alexey Tikhonov  ---
Upstream PR: https://github.com/SSSD/sssd/pull/8675

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Pavel Březina  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?([e-mail]
                   |                            |m)

--- Comment #9 from Pavel Březina  ---
Hi, would you mind to try out scratch build from COPR?

sudo dnf copr enable packit/SSSD-sssd-8675 fedora-44-x86_64
sudo dnf upgrade sssd*

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Dmitry  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?([e-mail] |
                   |m)                          |

--- Comment #10 from Dmitry  ---
Looks ok - offline mode is operational, no more 'Permission denied' errors.

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |POST

--- Comment #11 from Alexey Tikhonov  ---
(In reply to Alexey Tikhonov from comment #8)
> Upstream PR: https://github.com/SSSD/sssd/pull/8675

https://github.com/SSSD/sssd/commit/c5b631ee6df531b506d2b2ba7f2d9f0b9de02746

sssd-2-13: https://github.com/SSSD/sssd/pull/8701

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

--- Comment #12 from Alexey Tikhonov  ---
(In reply to Alexey Tikhonov from comment #11)
> sssd-2-13: https://github.com/SSSD/sssd/pull/8701

https://github.com/SSSD/sssd/commit/c3acaa3a5104ee32efdb536b311a343276afb5d0

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #13 from Alexey Tikhonov  ---
*** Bug 2481235 has been marked as a duplicate of this bug. ***

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Fedora Update System  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|POST                        |MODIFIED

--- Comment #14 from Fedora Update System  ---
FEDORA-2026-851bc3ae6a (sssd-2.13.1-1.fc44) has been submitted as an update to
Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-851bc3ae6a

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Fedora Update System  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |ON_QA

--- Comment #15 from Fedora Update System  ---
FEDORA-2026-851bc3ae6a has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh
--advisory=FEDORA-2026-851bc3ae6a`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2026-851bc3ae6a

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.

[Bug 2466974] SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors

https://bugzilla.redhat.com/show_bug.cgi?id=2466974

Fedora Update System  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |ERRATA
   Fixed In Version|                            |sssd-2.13.1-1.fc44
             Status|ON_QA                       |CLOSED
        Last Closed|                            |2026-06-12 00:59:46

--- Comment #16 from Fedora Update System  ---
FEDORA-2026-851bc3ae6a (sssd-2.13.1-1.fc44) has been pushed to the Fedora 44
stable repository.
If problem still persists, please make note of it in this bug report.