March 2015 - sssd-users - Fedora mailing-lists

full_name_format and supplemental groups
by Orion Poplawski 25 Oct '16

25 Oct '16

Running IPA with an AD trust. Users are in AD. Trying to use full_name_format = %1$s to strip the domain from user names. This appears to break supplemental groups in strange ways. On the IPA server: Without full_name_format: # id orion(a)ad.nwra.com uid=470202603(orion(a)ad.nwra.com) gid=470202603(orion(a)ad.nwra.com) groups=470202603(orion(a)ad.nwra.com),470200513(domain users(a)ad.nwra.com),470204703(pirep rd users(a)ad.nwra.com),470204714(wireless access@ad.nwra.com),470204715(nwra-users@ad.nwra.com),470204701(boulder@ad.nwra.com),470207608(heimdall users(a)ad.nwra.com),470200512(domain admins(a)ad.nwra.com),470207124(andreas admins(a)ad.nwra.com) With: # id orion(a)ad.nwra.com uid=470202603(orion) gid=470202603(orion) groups=470202603(orion) If I add: default_domain_suffix = ad.nwra.com # id orion uid=470202603(orion) gid=470202603(orion) groups=470202603(orion),470200512(domain admins),470207608(heimdall users),470204714(wireless access),470204715(nwra-users),470204701(boulder),470204703(pirep rd users),470207124(andreas admins),470200513(domain users) Which I guess makes some sense as you'd need to add the domain suffix back on to find the groups. But this appears to completely break IPA clients (with full_name_format = %1$s and default_domain_suffix = ad.nwra.com) # id orion(a)ad.nwra.com id: orion(a)ad.nwra.com: no such user # id orion id: orion: no such user >From looking at the server logs, it looks like only the IPA domain is searched If I reset the server back to normal (drop full_name_format and default_domain_suffix): # id orion uid=470202603(orion) gid=470202603(orion) groups=470202603(orion) I don't get any supplemental groups. I see sssd errors like: (Mon Mar 30 15:20:52 2015) [sssd[be[nwra.com]]] [sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory) (Mon Mar 30 15:20:52 2015) [sssd[be[nwra.com]]] [sysdb_update_members_ex] (0x0020): Could not add member [orion] to group [name=domain admins,cn=groups,cn=nwra.com,cn=sysdb]. Skipping. Is t trying "cn=groups,cn=nwra.com,cn=sysdb" instead of "cn=groups,cn=ad.nwra.com,cn=sysdb" -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

3 7

sssd able to login the user but failed on sudo
by Karim 07 May '15

07 May '15

Hi Team, i have two forests both working fine in terms of authentication. I added a user to sudoers from one of the domains and he is getting access denied. the user is able to login with no problem, sudo is not working. in the secure log it shows "account is expired" in the SSSD logs it shows error "attempting to kinit for realm xxxxxx" then "clients credentials has been revoked" i checked the account and it is not expired nor locked. additionally: I have another account on the same forest which i used to join to the domain and it is working fine on both authentication and sudoers. I also tried ldap_user_principal = no suchattribute and krb5_use_enterprise_principal = false but the problem remains. what could be the reason behind being able to access and later getting clients credential revoked for sudoes? Thanks

4 11

simple_allow_groups does not work: 4 (system error )
by Domenico Viggiani 21 Apr '15

21 Apr '15

Hi, on a Red hat 7.1 machine with latest updates, sssd/realmd authentication against AD works until I try to use simple_allow_groups, when access is denied for all with this error: pam_sss(sshd:account): Access denied for user testuser: 4 (System error) Setting debug_level = 7, at the end of the log, I see: (Mon Mar 16 16:57:52 2015) [sssd[be[CERVEDGROUP.COM]]] [simple_resolve_group_check] (0x1000): The group is still non-POSIX (Mon Mar 16 16:57:52 2015) [sssd[be[CERVEDGROUP.COM]]] [simple_resolve_group_done] (0x0040): Refresh failed (Mon Mar 16 16:57:52 2015) [sssd[be[CERVEDGROUP.COM]]] [simple_check_get_groups_next] (0x0040): Could not resolve name of group with GID 684028039 (Mon Mar 16 16:57:52 2015) [sssd[be[CERVEDGROUP.COM]]] [simple_access_check_done] (0x0040): Could not collect groups of user testuser (Mon Mar 16 16:57:52 2015) [sssd[be[CERVEDGROUP.COM]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 4, <NULL>) [Success] (Mon Mar 16 16:57:52 2015) [sssd[be[CERVEDGROUP.COM]]] [be_pam_handler_callback] (0x0100): Sending result [4][MYDOMAIN.COM] (Mon Mar 16 16:57:52 2015) [sssd[be[CERVEDGROUP.COM]]] [be_pam_handler_callback] (0x0100): Sent result [4][MYDOMAIN.COM] Full log is available but I need to "sanitize" it. Any help? Thanks in advance -- Mimmo

4 29

RHEL/CentOS 6 problems with missing supplemental groups for AD users
by John Beranek 17 Apr '15

17 Apr '15

Hi, I've been investigating problems with the SSSD 1.11 versions supplied in RHEL/CentOS 6.6 for a while now. I've followed: https://access.redhat.com/solutions/1264443 https://fedorahosted.org/sssd/ticket/2472 and also created a case with Red Hat support. However, I'm still no closer to solving the issue. After updating servers to the SSSD in 6.6, intermittently (for particular users but not on all servers, and not necessarily all the time) users don't get their supplementary groups. e.g: [root@rhel6-template sssd]# id matthewbe uid=46721(matthewbe) gid=20513(domain users) groups=20513(domain users) This is with the latest SSSD on a RHEL6.6 server, i.e.: sssd-1.11.6-30.el6_6.3.x86_64 Our environment is Windows 2003 AD controllers, and users *without* POSIX attributes in their AD records. So, snippets of sanitised sssd.conf: [domain/AD] debug_level = 9 id_provider = ad auth_provider = ad access_provider = ad chpass_provider = ad ad_server = dc01.local,dc02.local ad_backup_server = ad.local ad_domain = ad.local # ID mapping min_id = 20000 ldap_idmap_range_min = 20000 #ldap_idmap_range_max = 220000 ldap_idmap_range_size = 200000 ldap_idmap_default_domain_sid = S-1-5-21-2365159532-2245169678-2931239768 ldap_schema = ad ldap_id_mapping = true override_homedir = /home/AD/%u override_shell = /bin/bash # access controls ldap_access_order = expire ldap_account_expire_policy = ad ldap_force_upper_case_realm = true # performance ldap_referrals = false I've tried a few config changes to fix the issue, but none has fixed it, including: ldap_use_tokengroups = False ldap_group_objectsid = objectSID ldap_user_objectsid = objectSID ldap_deref_threshold = 0 ldap_schema = rfc2307bis Given Red Hat support hasn't been able to fix our issue, what else can I do? Cheers, John -- John Beranek To generalise is to be an idiot. http://redux.org.uk/ -- William Blake

2 7

ldb_modify_failed invalid attribute syntax
by Christopher Butt 15 Apr '15

15 Apr '15

Hi, I'm trying to authenticate against an AD domain. The first domain I did this on was almost flawlessly easy, but this time, on a different domain I'm having problems. I've searched, but I've mostly got fixed bugs from old versions. Like this one: https://bugzilla.redhat.com/show_bug.cgi?id=886848 which suggests that case sensitivity might have been an issue. Is it still one? My symptoms: 1) Some domain users aren't being recognised at all, 2) Some users are not getting the full groups list, eg just 'domain users' 3) Some users are connecting apparently fine with lots of AD groups visible from an 'id' or 'groups' command. So far it seems that the domain admins all work fine, but it's not clear if that's a coincidence or not. I've set up SSDB using realmd as follows: realm join -v internal.mydomain.com --user jn-monty --computer-ou=OU=Linux\ Servers,OU=Member\ Servers,DC=internal,DC=mydomain,DC=com (jn-monty is a domain-admin in this case.) [root@myserver admin]# sssd --version 1.12.2 [root@myserver admin]# cat /etc/sssd/sssd.conf [sssd] domains = internal.mydomain.com config_file_version = 2 services = nss, pam, pac [domain/internal.mydomain.com] ad_domain = internal.mydomain.com krb5_realm = INTERNAL.MYDOMAIN.COM realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = ad debug_level = 5 auth_provider = ad If I 'id' a missing user I get the following in the logs: [root@myserver admin]# id bqt-pmimon(a)internal.mydomain.com (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=bqt-pmimon] (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Invalid attribute syntax] (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sysdb_set_entry_attr] (0x0040): Error: 22 (Invalid argument) (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sdap_save_user] (0x0020): Failed to save user [BQT-PMimon] (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring. (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success id: bqt-pmimon(a)internal.mydomain.com: no such user If I 'id' a working user I get the following: [root@myserver admin]# id bqt-imartin(a)internal.mydomain.com (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=bqt-imartin] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [4] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [child_sig_handler] (0x0100): child [14296] finished successfully. (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: myserver$ (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'production-dc03v.internal.mydomain.com' as 'working' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [set_server_common_status] (0x0100): Marking server 'production-dc03v.internal.mydomain.com' as 'working' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1002][1][idnumber=680800513] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD_GC' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is neutral (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_ldap._tcp.internal.mydomain.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1003][1][name=bqt-imartin] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'production-dc03v.internal.mydomain.com' in files (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of 'production-dc03v.internal.mydomain.com' in files (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'production-dc03v.internal.mydomain.com' in DNS (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_gc._tcp.Prodtown._sites.trainline.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_gc._tcp.trainline.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [set_srv_data_status] (0x0100): Marking SRV lookup of service 'AD_GC' as 'resolved' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://production-dc03v.internal.mydomain.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://production-dc03v.internal.mydomain.com:3268' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [4] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://production-dc03v.internal.mydomain.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://production-dc03v.internal.mydomain.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [child_sig_handler] (0x0100): child [14297] finished successfully. (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: myserver$ (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_set_port_status] (0x0100): Marking port 3268 of server 'production-dc03v.internal.mydomain.com' as 'working' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [set_server_common_status] (0x0100): Marking server 'production-dc03v.internal.mydomain.com' as 'working' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_error_to_errno] (0x0020): LDB returned unexpected error: [No such attribute] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_update_members_ex] (0x0020): Could not remove member [bqt-imartin] from group [name=DLG-SC-vCenter Admin,cn=groups,cn=internal.mydomain.com,cn=sysdb]. Skipping (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_error_to_errno] (0x0020): LDB returned unexpected error: [No such attribute] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_update_members_ex] (0x0020): Could not remove member [bqt-imartin] from group [name=DLG-SC-Linux Admins,cn=groups,cn=internal.mydomain.com,cn=sysdb]. Skipping (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success uid=680803710(bqt-imartin(a)internal.mydomain.com) gid=680800513(domain users(a)internal.mydomain.com) groups=680800513(domain users(a)internal.mydomain.com) [root@myserver admin]# id bqt-imartin(a)internal.mydomain.com The information in this email (and any attachments) is confidential and is intended solely for the use of the individual or entity to whom it is addressed. If you received this email in error please tell us by reply email (or telephone the sender) and delete all electronic copies on your system or other copies known to you. Trainline Investments Holdings Limited (Registered No.5776685), Trainline.com Limited (Registered No. 3846791) and Trainline International Limited (Registered No. 6881309) are all registered in England and Wales with registered office at 50 Farringdon Road, London, EC1M 3HE.

4 8

automount Problem
by Günther J. Niederwimmer 09 Apr '15

09 Apr '15

Hello, On my system centos 7 my automount is not working. IPA 4.1 sssd 1.12 I have this Error ? automount[1899]: lookup_read_map: lookup(sss): getautomntent_r: No such file or directory have I to configure more in sssd ? Now I have this from ipa autofs_provider = ipa ipa_automount_location = default -- mit freundlichen Grüßen / best Regards, Günther J. Niederwimmer

3 8

Trouble with password authentication of AD users
by Orion Poplawski 01 Apr '15

01 Apr '15

I've got IPA running on an EL7.1 box for the domain NWRA.COM. I established a trust with our active directory domain (AD.NWRA.COM) The trust seem to be working mostly correctly, I can auto-login with AD kerberos tickets for example. However, password authentication for the AD users does not appear to be working: $ su - orion(a)AD.NWRA.COM Password: su: Authentication failure sssd log shows: (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [krb5_auth_prepare_ccache_name] (0x1000): No ccache file for user [orion(a)ad.nwra.com] found. (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA' (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [get_server_status] (0x1000): Status of server 'ipa.nwra.com' is 'working' (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [get_port_status] (0x1000): Port status of port 0 for server 'europa.nwra.com' is 'working' (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [get_server_status] (0x1000): Status of server 'europa.nwra.com' is 'working' (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [be_resolve_server_process] (0x0200): Found address for server ipa.nwra.com: [X.X.X.X] TTL 86400 (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [17483] (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [child_handler_setup] (0x2000): Signal handler set up for pid [17483] (Fri Mar 27 13:51:42 2015) [sssd[be[nwra.com]]] [write_pipe_handler] (0x0400): All data has been sent! (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [child_sig_handler] (0x1000): Waiting for child [17483]. (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [child_sig_handler] (0x0100): child [17483] finished successfully. (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [read_pipe_handler] (0x0400): EOF received, client finished (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [parse_krb5_child_response] (0x1000): child response [0][3][40]. (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [parse_krb5_child_response] (0x1000): child response [0][-1073741822][18]. (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [parse_krb5_child_response] (0x1000): child response [0][-1073741823][32]. (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [parse_krb5_child_response] (0x1000): TGT times are [1427485903][1427485903][1427521903][1427572303]. (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [parse_krb5_child_response] (0x1000): child response [0][6][8]. (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [krb5_auth_done] (0x0020): UPN used in the request [Orion Poplawski(a)AD.NWRA.COM] and returned UPN [orion(a)AD.NWRA.COM] differ by more than just the case. (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [ipa_auth_handler_done] (0x0040): krb5_auth_recv request failed. (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 4, <NULL>) [Success] (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [be_pam_handler_callback] (0x0100): Sending result [4][ad.nwra.com] (Fri Mar 27 13:51:43 2015) [sssd[be[nwra.com]]] [be_pam_handler_callback] (0x0100): Sent result [4][ad.nwra.com] The UPN message seems like an issue. Ideas? ipa-server-4.1.0-18.sl7_1.3.x86_64 sssd-1.12.2-58.el7.x86_64 -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

4 8

sssd in a mixed 2003/2008 servers AD environment
by YVAN MASSON 31 Mar '15

31 Mar '15

Hi everybody, First, thanks for this great tool ! With a very simple setup, it allows me to use dozens of *Ubuntu 14.04 (sssd version 1.11.5-1ubuntu3) computers in the AD environment of my school, where I have two 2003 servers. I tried to help a collegue to do the same in another school (where there is a mix of 2003 and 2008 servers), but I failed : the problem seems to come from Kerberos, because I found messages of this type in the sssd logs : "... has no support for encryption type". The enrollment of the computer in the realm was OK, but users login sometimes fails. In some blog I can't find anymore, it was written that old encryption types (DES) was not supported anymore on 2008 servers, so I tried to force some Kerberos options ("krb5_use_kdcinfo = false" in sssd.conf and "allow_weak_crypto = 1" in /etc/krb5.conf). The sssd logs let think that /etc/krb5.conf is looked, but the result is the same. The only thing "working" was to prevent the computer to talk with the 2003 server with iptables, but this is a horrible and annoying hack. So my question are : - Does anyone alredy managed to use sssd in this type of environment ? - Would you have any idea where to look for better debugging ? Thanks very much, Yvan Masson

3 4

Using separate ldap servers for authentication and auto mount information
by Matt John 27 Mar '15

27 Mar '15

We are in the process of attempting to transition to SSSD mainly as we like the idea of a single configuration file. We currently have two ldap servers (this cannot be changed) where one is used for user authentication and the other provides information on automounts. The ldap server used for automounts only contains a subset of the users in the other ldap server as not all users are able to, or have the need to, log into our systems. So far we have been unsuccessful in getting SSSD to work for both authentication and autofs. We can get them to work independently but no amount of Googling has come up with a solution as how to combine the two. All users share the same username in both servers and uid although the gid must come from the automount ldap server (both uid and gid are the same actually). Our conf file so far is given below with some information redacted. Is it possible to combine the information from both the ldap servers using SSSD? [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam, autofs domains = authd, autofsd [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] reconnection_retries = 3 [autofs] [domain/autofsd] ldap_id_use_start_tls = True cache_credentials = False ldap_search_base = dc=test,dc=example.com ldap_uri = ldap://ldap1.example.com/ ldap_tls_cacert = /etc/ssl/certs/example.pem id_provider = ldap autofs_provider = ldap ldap_autofs_search_base = dc=test,dc=example.com [domain/authd] ldap_id_use_start_tls = True cache_credentials = False ldap_search_base = dc=test,dc=example.com enumerate = False chpass_provider = ldap id_provider = ldap auth_provider = ldap ldap_uri = ldap://ldap2.example.com/ ldap_tls_cacert = /etc/ssl/certs/example.pem autofs_provider = none

4 19

Re: [SSSD-users] sssd Ubuntu 14.04 LTS
by Timo Aaltonen 26 Mar '15

26 Mar '15

On 26.03.2015 16:19, Ludger Koehler wrote: > Hi Timo, > > sorry but i have a Question. > > We use Ubuntu 14.04 LTS Server with sssd-ad to authenticate over Windows > 2008 R2 AD and it works. > But there is one Problem, "ad_access_filter" don't work. > > in sssd.conf the parameter > access_provider = ad > ad_access_filter = > DOM:(&(objectCategory=Group)(objectClass=samaccountname)(|(ou=group1)(ou=group2)(ou=group3))) > > is set. > > Other Filter like > ad_access_filter = > (|(memberOf=cn=group1,ou=gruppen,ou=examle,dc=test,dc=de)(memberOf=cn=group2,ou=gruppen,ou=example,dc=test,dc=de)(memberOf=cn=group3,ou=gruppen,ou=example,dc=test,dc=de)) > > don't work too. > > Do you have an idea, whats the Problem or is it a Bug? I guess the sssd-users list is better for questions like these, I don't know the answer off-hand. (sssd version in 14.04 is still at 1.11.5 btw, if relevant here) -- t

2 1

sssd many ccache-files
by Sebastian.Gumprich＠t-systems.com 25 Mar '15

25 Mar '15

Hi sssd users, sssd creates many ccache-files under /var/lib/sss/db/. They become so much, that the maximum number of inodes (default: 32768) for the partition is reached. This results in several other problems (failed logins, processes can't create sockets, etc). Why are so many files created? Is there a way to limit the maximum number of created files? Right now I'm running a daily Cronjob that deletes the sssd-cache (sss_cache -E). I'm running RHEL6.6 and sssd 1.11.6 with AD as backend. Linux 2.6.32-504.el6.x86_64 #1 SMP Tue Sep 16 01:56:35 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux Thanks Sebastian

3 3

autofs support
by Paul B. Henson 19 Mar '15

19 Mar '15

Not too long back, we noticed a mention in a RHEL6 release note that sssd supported autofs now. We currently run autofs directly against ldap, but just for fun we thought we'd see how well it played with sssd, which is using the same ldap system for users/groups. Unfortunately, our initial try was unsuccessful. Based on reviewing the code, it looks like sssd wants to download the *entire* autofs map, including all entries, from ldap in order it serve it to autofs? We have something like 120000 users/groups, so that's not really feasible or desirable 8-/. Am I understanding the operation correctly? Or is there some way to get it to look up map entries as necessary like it does for users/groups? It doesn't try to suck all of the users or all of the groups out of ldap at initialization, I'm not sure why it wants to do so for autofs maps. Thanks...

4 27

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

Re: [SSSD-users] simple_allow_groups does not work: 4 (system error )
by Domenico Viggiani 18 Mar '15

18 Mar '15

> -----Original Message----- > From: Domenico Viggiani [mailto:dviggiani@tiscali.it] > > > -----Original Message----- > > > > Then I'm 100% sure we have a bug. The group shouldn't have the non- > > posix flag after it was updated. > > > > Can you tell us anything about this group: > > (Mon Mar 16 16:57:52 2015) [sssd[be[MYDOMAIN.COM]]] [sdap_save_group] > > (0x1000): Mapping group [Organigramma] objectSID [S-1-5-21- > 2248061571- > > 2151176789-1472819363-28039] to unix ID > > > > Is it from the same domain? What type does the group have? > > Searching for name "Organigramma", I get three results: > > dn: OU=Organigramma,OU=Liste di Distribuzione,DC=mydomain,DC=COM > ... Jakub, sorry for disturbance: had you a chance to review this problem? We are currently forced to allow login to all users on Red Hat 7 boxes. Do you suggest to open a 'parallel' ticket with Red Hat? Thanks --

2 1

autofs for different audiences or device types
by Brendan Kearney 17 Mar '15

17 Mar '15

i want to run different automounts for users on workstations or laptops vs users logging into servers. also, i would like certain processes to have different automounts. say i have a user, and the user automounts server:/directory under /home/user/localdir when logged into their daily-driver device. when that user logs into a server, i dont want that user to get the automount. how are people differentiating automounts for a given audience? i figure i could create different automountMaps and point the particular devices to specific maps, but is there a way to have all configs be the same and have the differentiation done in LDAP? say all devices point to one auto.master and get direct and/or indirect mappings from one place. is there a way to add criteria for which mappings are returned? you only get these keys if you are in this ip range or you only get those keys if the DNS name of the client machine is "host.domain.tld"? is it just easier to have different auto.masters for the different devices or audience i want to manage? thank you, brendan

3 2

SSSD with different AD UPN Suffixes
by Eugene Peregudov 11 Mar '15

11 Mar '15

Hi, I'm trying to authenticate Active Directory users with different UPN suffixes on my Linux machine. As described in article (http://jhrozek.livejournal.com/3019.html) SSSD should support for enterprise logins: "some users in AD might use a different Kerberos Principal suffix than the default one". I have two users with different UPN - user1(a)domain.example.com and user2(a)department.example.com #getent passwd user1(a)domain.example.com returns valid user entry, but #getent passwd user2(a)department.example.com returns nothing... What's wrong? Can anyone help me with this issue? Thanks! Target system: Red Hat Enterprise Linux Server release 7.0 (Maipo) host1.domain.example.com 3.10.0-123.13.2.el7.x86_64 x86_64 x86_64 x86_64 GNU/Linux sssd-1.11.2-68.el7_0.6.x86_64 --------------------------------------------------------------- Active Directory Domain: schema: 2008 R2 tld: domain.example.com --------------------------------------------------------------- Linux machine joined AD using command: #adcli join domain.example.com -U admin -S dc1.domain.example.com -H host1.domain.example.com -v -W --------------------------------------------------------------- sssd.conf: [sssd] config_file_version = 2 services = nss, pam domains = DOMAIN.EXAMPLE.COM [nss] [pam] [domain/DOMAIN.EXAMPLE.COM] debug_level = 10 id_provider = ad auth_provider = ad chpass_provider = ad access_provider = ad ad_domain = domain.example.com ad_server = dc1.domain.example.com,10.0.0.2 ad_hostname = host1.domain.example.com ldap_id_mapping = false ldap_schema = rfc2307 krb5_use_enterprise_principal = true enumerate = false entry_cache_timeout = 60 fallback_homedir = /home/org/users/%u shell_fallback = /bin/false dyndns_update = true --------------------------------------------------------------- krb5.conf: [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_realm = DOMAIN.EXAMPLE.COM default_ccache_name = KEYRING:persistent:%{uid} dns_lookup_kdc = false [realms] DOMAIN.EXAMPLE.COM = { kdc = dc1.domain.example.com kdc = 10.0.0.2 admin_server = dc1.domain.example.com admin_server = 10.0.0.2 default_domain = domain.example.com } [domain_realm] .domain.example.com = DOMAIN.EXAMPLE.COM domain.example.com = DOMAIN.EXAMPLE.COM [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } --------------------------------------------------------------- sssd_DOMAIN.EXAMPLE.COM.log: [sbus_dispatch] (0x4000): dbus conn: 0x7f75d0504770 [sbus_dispatch] (0x4000): Dispatching. [sbus_message_handler] (0x4000): Received SBUS method [ping] [sbus_dispatch] (0x4000): dbus conn: 0x7f75d0519b20 [sbus_dispatch] (0x4000): Dispatching. [sbus_message_handler] (0x4000): Received SBUS method [getDomains] [be_get_subdomains] (0x0400): Got get subdomains [forced][department.example.com] [be_queue_request] (0x4000): Queue is empty, running request immediately. [be_queue_request] (0x4000): Adding request to queue. [sdap_id_op_connect_step] (0x4000): reusing cached connection [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [objectclass=domain][DC=domain,DC=example,DC=com]. [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 11 [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052de50], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] [sdap_parse_entry] (0x4000): OriginalDN: [DC=domain,DC=example,DC=com]. [sdap_parse_range] (0x2000): No sub-attributes for [objectSid] [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052de50], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set [ad_master_domain_next_done] (0x0400): Found SID [S-1-5-21-1505972566-2156897661-2636268315]. [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(DnsDomain=domain.example.com)(NtVer=\14\00\00\00))][]. [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [netlogon] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 12 [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d0530150], ldap[0x7f75d0521980] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d0530150], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] [sdap_parse_entry] (0x4000): OriginalDN: []. [sdap_parse_range] (0x2000): No sub-attributes for [netlogon] [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d0530150], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set [ad_master_domain_netlogon_done] (0x0400): Found flat name [DOMAIN]. [ad_master_domain_netlogon_done] (0x0400): Found forest [domain.example.com] [ad_subdomains_master_dom_done] (0x0400): Connected to forest root, looking up child domains.. [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectclass=trustedDomain)(trustType=2)(!(msDS-TrustForestTrustInfo=*)))][DC=domain,DC=example,DC=com]. [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [flatName] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [trustPartner] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [securityIdentifier] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [trustType] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [trustAttributes] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 13 [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052e870], ldap[0x7f75d0521980] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052e870], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052e870], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052e870], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052e870], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set [sdap_id_op_done] (0x4000): releasing operation connection [ad_subdomains_get_slave_domain_done] (0x1000): There are no changes [get_subdomains_callback] (0x0400): Backend returned: (0, 0, <NULL>) [Success] [be_queue_next_request] (0x4000): Request queue is empty. [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[(nil)], ldap[0x7f75d0521980] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! [be_ptask_execute] (0x0400): Task [Cleanup of DOMAIN.EXAMPLE.COM] executing task, timeout 10800 seconds --------------------------------------------------------------- -- With best regards, Eugene JONIK Peregudov mailto: eugene.peregudov(a)gmail.com

3 11

GSSAPI Errors with AD Trust
by Baird, Josh 11 Mar '15

11 Mar '15

Hi, I'm having an issue with IPA/sssd (RHEL 7.1) when accessing resources through an AD trust. The following is logged in ldap_child.log (debug_level=10): (Tue Mar 10 12:31:12 2015) [sssd[be[unix.domain.com]]] [sasl_bind_send] (0x0080): Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (KDC has no support for encryption type)] This error seems to occur randomly. We have over 40+ DC's in our HUB site for active directory forest/domain. All of these DC's are running either Windows 2008 R2/Windows 2012/Windows 2012 R2. The domain/forest level is still Windows 2003. The trust is established between IPA (unix.domain.com) and the forest root AD domain (domain.com) The AD users actually exist in a child domain (ad.domain.com) I conducted a test where I deleted the sssd server cache (in /var/lib/sss/db/), restarted sssd, and then did a 'getent passwd user(a)domain.com.' There were several instances where sssd was successfully using one of the AD DC's, and then after clearing the cache and restarting failed on the same AD DC with the "KDC has no support for encryption type" error. Nothing is being logged to /var/log/sssd/krb5_child.log. We are running the following versions: ipa-server-4.1.0-18.el7.x86_64 ipa-server-trust-ad-4.1.0-18.el7.x86_64 sssd-1.12.2-58.el7.x86_64 Does anyone have an idea of what may be happening here? Thanks, Josh

2 1

How to purge sssd cache
by Varun Mittal3 09 Mar '15

09 Mar '15

Hi We are using sssd available on RHEL 7 and have a query on purging sssd cache incase domain goes offline. We are using just the UID/GID and group membership for users. And netgroups (both LDAP and NIS proxy) in some cases As I understand, sss_cache utility only invalidates the records, which marks them expired. Whenever the domain is online, these will be refreshed. But if the domain is offline, those expired records will still be returned as valid. - Please reconfirm if this understanding is correct - And if this is correct, then is there a way to purge the records to return users/group queries invalid if domain is offline Thanx & Regards, Varun Mittal

4 6

FreeIPA/SSSD LDAP cross-forest trust slow queries
by Aviolat Romain 06 Mar '15

06 Mar '15

Hi, We have setup FreeIPA (VERSION: 4.1.2, API_VERSION: 2.109) in our realm (IPA.DOMAIN1.COM) with trust to an AD forest (DOMAIN2.NET, which itself has trust to AD.DOMAIN2.NET, where the corporate users are). Everything works fine when using Kerberos, we can obtain tickets from AD.DOMAIN2.NET and authenticate to services in IPA.DOMAIN1.COM. We can also do "getent passwd user(a)ad.domain2.net" on a host enrolled in FreeIPA and quickly get a result. But we have some legacy applications that perform authentication with simple LDAP binds, so we have the compat tree enabled, and while trying to authenticate users in the AD.DOMAIN2.NET realm this way eventually succeeds, it takes an awfully long time (30 seconds or so, sometimes more), with a lot going on between the AD and FreeIPA. We've attached the log file of SSSD (version 1.12.4, we've upgraded based on advice from IRC #sssd, but the problem didn't go away) from the FreeIPA server while running "ldapwhoami -D uid=user(a)ad.domain2.net,cn=users,cn=compat,dc=ipa,dc=domain1,dc=com -W" from a client machine. The debug level was set to 0x07f0. On (rare) occasions, authentication is very fast while running the exact same command on the client machine. We've also attached the SSSD log file when that happens, for comparison. The log files have been sanitized and the slow log output was bit simplified, we removed 25 repeated events where sssd was trying to resolve unknown SIDs, it would have taken too much time to sanitize so we left 5 caching events only (we made a remark on the log file where we removed those lines.) Any advice is more than welcome. Thanks for your help. Cheers, Romain Aviolat Senior System Administrator - R&D and ops Infrastructure Kudelski Security - Kudelski Group rte de Genève 22-24, 1033 Cheseaux, SWITZERLAND +41 21 732 03 79

5 13

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users March 2015