sssd auth issue on centos 5.10
by Daniel Jung
Hi,
sssd shows the following error when a user tries to log on using password.
enumerate is false. Using 1.5.1.70
Any idea why this is happening?
Thanks
(Mon Aug 11 19:47:39 2014) [sssd] [mt_svc_exit_handler] (2): Child [LDAP]
terminated with signal [11]
(Mon Aug 11 19:47:39 2014) [sssd] [sbus_dispatch] (3): Connection is not
open for dispatching.
(Mon Aug 11 19:47:39 2014) [sssd] [mt_svc_restart] (6): Scheduling service
LDAP for restart 1
(Mon Aug 11 19:47:39 2014) [sssd] [start_service] (4): Queueing service
LDAP for startup
(Mon Aug 11 19:47:39 2014) [sssd] [sbus_server_init_new_connection] (5):
Entering.
(Mon Aug 11 19:47:39 2014) [sssd] [sbus_server_init_new_connection] (5):
Adding connection 0x129cea40.
(Mon Aug 11 19:47:39 2014) [sssd] [sbus_init_connection] (5): Adding
connection 129CEA40
(Mon Aug 11 19:47:39 2014) [sssd] [sbus_server_init_new_connection] (5):
Got a connection
(Mon Aug 11 19:47:39 2014) [sssd] [monitor_service_init] (3): Initializing
D-BUS Service
(Mon Aug 11 19:47:39 2014) [sssd] [client_registration] (4): Received ID
registration: (%BE_LDAP,1)
(Mon Aug 11 19:47:39 2014) [sssd] [mark_service_as_started] (5): Marking
LDAP as started.
9 years, 8 months
Startup segfault loop of domain_be on Ubuntu 14.04
by Chris Hartman
Hi guys,
Ubuntu 14.04 x86_64
SSSD 1.11.5
Active Directory backend
I've been experiencing this problem for a few weeks with no luck in
troubleshooting it. During boot, the sssd_be process will continually spawn
and crash due to a segfault. When it gets stuck in this loop, domain
account login is almost impossible (local accounts still work).
I've attached sanitized logs and my sssd.conf file. Please have a look and
let me know what you think. Thanks!
-Chris
9 years, 8 months
using ldap -> sssd -> AD (sssd as a proxy)
by Gerardo Padierna
Hi,
I'd like to know if it somehow possible to use sssd as a proxy
authenticator, by which I mean the following:
· I want to authenticate users defined on a windows AD 2003 server on a
Solaris box (sssd is not available)
· I'm already using sssd on RHEL boxes -> I'd like to maintain the same
UID/GID mapping on the Solarix boxes as those already used on the RHEL
machines
· I was wondering if there's a conf (or a hack) that makes it possible
to authenticate an AD user on a box (which can't run sssd) the following
way:
Soraris box -> asks ldap server -> asks sssd (on same box or not) -> asks AD
Since sssd is a client, I can't figure out how to do that, but maybe
there's a way (that's why I was thinking that maybe, by combining an
ldap server with sssd, they could act together as an authentication
provider).
Again: The reason why not using directly just one ldap client on the
Solaris boxes is to maintain the same UID/GIDs already defined in other
sssd-based hosts.
Thanks a lot for any suggestions on this.
--
*Gerardo Padierna Nanclares*
<mailto:asl.gerardo@gmail.com>
9 years, 8 months
id, ACLs, and remote groups
by Peter Kirby
I'm running CentOS 7, fully updated with SSSD version 1.11.2. I used realm
to setup SSSD and everything seems to be working fine for authentication.
I'm even able to filter access based on an ldap group. My id and access
providers are both set to ad.
When I try to run: id username, all I get is the "domain users" group
listed as the primary group. However, if I run something like: getent
group test-group, and then again run id on a user in that group, test-group
now shows up in the list along with domain users.
While I don't particularly care about the output from id, I'm seeing the
same behavior when trying to use ACLs. The scenario is the same as above.
Before getent group test-group, the users do not have access via ACL to
files. As soon as I run getent, everything starts working as it should.
I have tried enumerate = true in sssd.conf and confirmed sss is in
nsswitch.conf where it should be, but I cannot seem to make remote groups
work.
I suspect I'm missing something very small, but I've been searching
manuals, google, and the logs for days and I haven't found any solution
yet. I would appreciate any suggestions anyone might have.
Thanks,
Peter
--
Peter Kirby
System and Database Administrator @ Harding University
9 years, 8 months
sssd with ctdb
by steve
Hi
Can we use sssd instead of winbind in a ctdb cluster joined to AD in the
same way it works on a non clustered file server?
Cheers,
Steve
9 years, 8 months
krb5_child can't create ccache with error 13 [Permission Denied]
by Chris Malton
Hi guys,
I'm fairly sure I'm missing something here, but I can't see why.
For some reason, I get this in the logs:
(Wed Aug 20 07:51:33 2014) [[sssd[krb5_child[3650]]]]
[sss_get_ccache_name_for_principal] (0x4000): Location:
[FILE:/tmp/krb5cc_1332601725_XXXXXX]
(Wed Aug 20 07:51:33 2014) [[sssd[krb5_child[3650]]]]
[sss_get_ccache_name_for_principal] (0x2000): krb5_cc_cache_match
failed: [-1765328243][Can't find client principal cmalton_it(a)KEGS.LOCAL
in cache collection]
(Wed Aug 20 07:51:33 2014) [[sssd[krb5_child[3650]]]] [create_ccache]
(0x0020): 574: [13][Permission denied]
So... here's some debug logs/configs:
krb5_child log: http://paste.ubuntu.com/8095446/
sssd_kegs.local.log: http://paste.ubuntu.com/8095643/
krb5.conf: http://paste.ubuntu.com/8095464/
sssd.conf: http://paste.ubuntu.com/8095470/
# ls -alh /tmp
total 16K
drwxrwxrwx 2 root root 4.0K Aug 20 08:21 .
drwxr-xr-x 22 root root 4.0K Jul 8 19:40 ..
-rw------- 1 root root 7.4K Aug 20 07:19 krb5cc_0
I'm at a loss - anyone else able to tell me what's wrong or point me in
the right direction?
Cheers,
Chris
9 years, 8 months
Re: [SSSD-users] Caching credentials while online
by Jacob Weber
> I've marked #2408 as a duplicate of #1807. Sorry I made you file another
> ticket, Jacob. But #1807 is present in 1.13 which is the next upstream
> version we'll be working on and I doubt we'd had time to implement this
> RFE sooner.
No problem. I'm going to use mod_authz_ldap to deal with my Apache problem for now, since that has caching. But it would be nice to have some caching for normal logins, to reduce the load on the LDAP server.
Jacob
9 years, 8 months
Re: [SSSD-users] Caching credentials while online
by Jacob Weber
> Can you file a RFE?
Sure: https://fedorahosted.org/sssd/ticket/2408
> Could you check in the logs what takes the longest during the whole
> request? If your server is really fast, maybe you can add
> debug_microseconds to the config file to increase the resolution..
I tried, but I'm not seeing a particular area that's slower than others. I can try looking more carefully when I have some time.
The lookup doesn't make a huge difference in one request, but it adds up.
In particular, this machine runs Subversion over Apache, and authenticates against the system users (using SSSD). Unfortunately SVN over Apache makes a ton of separate requests. Since SSSD doesn't cache, I'm probably going to look into having Apache use a method that does, like mod_ldap.
> Maybe the new option could cover both the initgroups and authentication,
> not sure. It's a bit of slippery slope, because on a Linux system
> authentication is actually the only moment where groups are set. On the
> other hand, group membership don't change that often..
Plus, if you're doing offline caching, you're already going down that slope...
Jacob
9 years, 8 months
Caching credentials while online
by Jacob Weber
Using SSSD with LDAP, is it possible to cache credentials for a period, even while online? I'd like to speed up authentication on certain servers.
I have cache_credentials = true in sssd.conf. When I authenticate, I can see "Password successfully cached for [username]" in the log file. Then if I go offline, the cache is used. But while I'm online, it contacts the server each time.
Thanks,
Jacob
9 years, 8 months
