October 2016 - sssd-users - Fedora mailing-lists

Enumerate users from external group from AD trust
by Bolke de Bruin 29 Nov '19

29 Nov '19

Hello, I have sssd 1.13.00 working against FreeIPA 4.2 domain. This domain has a trust relationship with a active directory domain. One of the systems we are using requires to enumerate all users in groups by (unfortunate) design (Apache Ranger). This is done by using “getent group”. During this enumeration the full user list for a group that has a nested external member group* is not always returned so we thought to add “getent group mygroup” in order to get more details. Unfortunately this does not seem to work consistently: sometimes this gives information sometimes it does not: [root@master centos]# getent group ad_users ad_users:*:1950000004: [root@master centos]# id bolke(a)ad.local UID=1796201107(bolke(a)ad.local) GID=1796201107(bolke(a)ad.local) groepen=1796201107(bolke(a)ad.local),1796200513(domain users@ad.local),1796201108(test@ad.local) [root@master centos]# getent group ad_users ad_users:*:1950000004:bolke@ad.local <mailto:bolke@ad.local> If I clear the cache (sss_cache -E) the entry is gone again: [root@master centos]# getent group ad_users ad_users:*:1950000004: My question is how do I get sssd to enumerate *all users* in a group consistently? Thanks! Bolke * https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/trust-gro…

3 15

'no primary group ID provided' when trying to use ldap mode against AD
by Daniel Hermans 24 Apr '17

24 Apr '17

Hi, i'd like to use sssd in ldap mode against Active Directory so I have defined: id_provider = ldap auth_provider = ldap Yes krb5 would be better but i only have a BIND account and cannot add computer objects. This 'should' be possible - it works with nslcd. As I don't have Posix attributes i'm using: ldap_id_mapping = true fallback_homedir = /home/%d/%u default_shell = /bin/bash sssd can bind with LDAPS and can seem to get user info from the domain: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=Some User,OU=Admin Accounts,DC=dev,DC=somedomain,DC=com]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_result] (0x2000): Trace: sh[0x7f5d15fbc030], connected[1], ops[0x7f5d1639d140], ldap[0x7f5d15fb5cd0] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_op_destructor] (0x2000): Operation 3 finished (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x4000): Retrieved total 1 users The UID mapping seems to succeed: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Save user (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x4000): Failed to retrieve UUID [2][No such file or directory]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_primary_name] (0x0400): Processing object someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Processing user someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x1000): Mapping user [someuser] objectSID [S-1-5-21-3970895924-989261097-3267629119-1443] to unix ID But it gets no further with this message: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_idmap_primary_gid] (0x0080): no primary group ID provided (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Cannot get the GID for [someuser] in domain [extdev]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Failed to save user [someuser] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring. Have tried against two different domains with identical result ( one a cleanly installed 2012R2 domain ). Any ideas what I'm doing wrong? Is this possible? Various (old) posts suggests it is. This was first (incorrectly) posted to sssd-devel, Jakub Hrozek updated and told me to define ldap_idmap_default_domain_sid so sssd no longer reports this: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain Thanks in advance!!

4 9

sssd-13.4 can't login
by Longina Przybyszewska 01 Dec '16

01 Dec '16

Hi, Can you help me with a problem I struggle quite a time, that appeared after upgrade to sssd-13.4 (Ubuntu Xenial): User can not login; Home directory (nfs) secured with Kerberos, is mounted, with proper idmapping, but user is refused to login to the desktop (lightdm). Ssh login is possible, but permission denied to access the home directory. This is setup with: .. id_provider=ad use_fully_qualified_names = true ldap_id_mapping = false .. In the krb5_child.log I can see suspicious sequence about "krb5_cc_cache_match failed"; Output from the log: -- Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.933479: Sending request (8186 bytes) to A DM.C.DOMAIN (tcp only) (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.934588: Resolving hostname host0a.adm. c.domain. (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.936998: Initiating TCP connection to stre am 10.144.5.5:88 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.938147: Sending TCP request to stream 10. 144.5.5:88 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.946674: Received answer (8380 bytes) from stream 10.144.5.5:88 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.946720: Terminating TCP connection to str eam 10.144.5.5:88 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948199: Response was not from master KDC (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948264: Decoding FAST response (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948342: FAST reply key: rc4-hmac/12E4 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948366: TGS reply is for user(a)NAT.C.SD U.DK -> host/lnx-adm557.a.c.domain(a)A.C.DOMAIN with session key aes256-cts/31E4 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948401: TGS request result: 0/Success (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948407: Received creds for desired servic e host/lnx-adm557.a.c.domain(a)A.C.DOMAIN (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948416: Storing user(a)N.C.DOMAIN -> h ost/lnx-adm557.a.c.domain(a)A.C.DOMAIN in MEMORY:gNruZJ9 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948440: Creating authenticator for user(a)N.C.DOMAIN -> host/lnx-adm557.a.c.domain(a)A.C.DOMAIN, seqnum 0, subkey (null), session key aes256-cts/31E4 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948500: Retrieving host/lnx-adm557.a.c.domain(a)A.C.DOMAIN from MEMORY:/etc/krb5.keytab (vno 6, enctype aes256-cts) with result: 0/Success (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948585: Decrypted AP-REQ with specified server principal host/lnx-adm557.a.c.domain(a)A.C.DOMAIN: aes256-cts/DDBF (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948594: AP-REQ ticket: user(a)N.C.DOMAIN -> host/lnx-adm557.a.c.domain(a)A.C.DOMAIN, session key aes256-cts/31E4 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948813: Negotiated enctype based on authenticator: aes256-cts (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948828: Initializing MEMORY:rd_req2 with default princ user(a)N.C.DOMAIN (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948837: Storing user(a)N.C.DOMAIN -> host/lnx-adm557.a.c.domain(a)A.C.DOMAIN in MEMORY:rd_req2 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948849: Destroying ccache MEMORY:gNruZJ9 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [validate_tgt] (0x0400): TGT verified using key for [host/lnx-adm557.a.c.domain(a)A.C.DOMAIN] (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948876: Retrieving user(a)N.C.DOMAIN -> host/lnx-adm557.a.c.domain(a)A.C.DOMAIN from MEMORY:rd_req2 with result: 0/Success (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.948967: Retrieving LNX-ADM557$(a)A.C.DOMAIN from MEMORY:/etc/krb5.keytab (vno 6, enctype aes256-cts) with result: 0/Success (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_send_pac] (0x0040): sss_pac_make_request failed [-1][2]. (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [validate_tgt] (0x0040): sss_send_pac failed, group membership for user with principal [user\@N.C.DOMAIN@A.C.DOMAIN] might not be correct. (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_child_krb5_trace_cb] (0x4000): [3331] 1477404875.949031: Destroying ccache MEMORY:rd_req2 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_get_ccache_name_for_principal] (0x4000): Location: [FILE:/tmp/krb5cc_10002_XXXXXX] (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [sss_get_ccache_name_for_principal] (0x2000): krb5_cc_cache_match failed: [-1765328243][Can't find client principal user(a)N.C.DOMAIN in cache collection] (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [create_ccache] (0x4000): Initializing ccache of type [FILE] (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [create_ccache] (0x4000): returning: 0 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [switch_creds] (0x0200): Switch user to [10002][30000000]. (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [switch_creds] (0x0200): Already user [10002]. (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [k5c_send_data] (0x0200): Received error code 0 (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [pack_response_packet] (0x2000): response packet size: [138] (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [k5c_send_data] (0x4000): Response sent. (Tue Oct 25 16:14:35 2016) [[sssd[krb5_child[3331]]]] [main] (0x0400): krb5_child completed successfully -- ls -l /tmp/krb5cc_10002_gIeneD -rw------- 1 user(a)n.c.domain lnx-primary(a)a.c.domain 16482 Oct 25 16:14 /tmp/krb5cc_10002_gIeneD klist -c /tmp/krb5cc_10002_gIeneD Ticket cache: FILE:/tmp/krb5cc_10002_gIeneD Default principal: user(a)N.C.DOMAIN Valid starting Expires Service principal 10/25/2016 16:14:35 10/26/2016 02:14:35 krbtgt/N.C.DOMAIN(a)N.C.DOMAIN renew until 10/26/2016 02:14:35 10/25/2016 16:14:36 10/26/2016 02:14:35 krbtgt/C.SDU.DK(a)N.C.DOMAIN renew until 10/26/2016 02:14:35 10/25/2016 16:14:36 10/26/2016 02:14:35 nfs/adm-lnx-nfs0a.a.c.domain@ renew until 10/26/2016 02:14:35 10/25/2016 16:14:36 10/26/2016 02:14:35 nfs/adm-lnx-nfs0a.a.c.domain(a)A.C.DOMAIN renew until 10/26/2016 02:14:35 Best, Longina

3 7

sssd monitor_quit_signal - causes? No matching domain found for [root], fail!
by Richard Collins 25 Nov '16

25 Nov '16

Running Red Hat Enterprise Linux Server release 6.5 (Santiago) - 2.6.32-431.el6.x86_64 SSSD version: sssd-1.13.3-22.el6_8.4.x86_64 I'm seeing (seemingly random?) shutdown/termination of sssd across multiple nodes, all with the same configuration. To my knowledge there is no process going around killing things, we even have a scheduled job to check sssd status and restart every 5 minutes if unavailable: /var/log/sssd/sssd.log:284469:(Mon Sep 26 12:21:29 2016) [sssd] [monitor_quit_signal] (0x2000): Received shutdown command /var/log/sssd/sssd.log:318707:(Mon Sep 26 16:19:19 2016) [sssd] [monitor_quit_signal] (0x2000): Received shutdown command /var/log/sssd/sssd.log:321889:(Mon Sep 26 16:43:12 2016) [sssd] [monitor_quit_signal] (0x2000): Received shutdown command /var/log/sssd/sssd.log:474327:(Tue Sep 27 10:29:39 2016) [sssd] [monitor_quit_signal] (0x2000): Received shutdown command /var/log/sssd/sssd.log:475205:(Tue Sep 27 10:34:36 2016) [sssd] [monitor_quit_signal] (0x2000): Received shutdown command Right before each shutdown, there are lots of the following nss_cmd_getbynam and sss_ncache_check_str entries for 'root' in sssd_nss.log: (Mon Sep 26 16:43:11 2016) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [38][SSS_NSS_INITGR] with input [root]. (Mon Sep 26 16:43:11 2016) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'root' matched without domain, user is root (Mon Sep 26 16:43:11 2016) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [root] from [<ALL>] (Mon Sep 26 16:43:11 2016) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/MYDOMAIN/root] (Mon Sep 26 16:43:11 2016) [sssd[nss]] [nss_cmd_initgroups_search] (0x0400): User [root] does not exist in [MYDOMAIN]! (negative cache) (Mon Sep 26 16:43:11 2016) [sssd[nss]] [nss_cmd_initgroups_search] (0x0080): No matching domain found for [root], fail! (Mon Sep 26 16:43:11 2016) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0xf7e120][24] (Mon Sep 26 16:43:12 2016) [sssd[nss]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down (Mon Sep 26 16:43:12 2016) [sssd[nss]] [client_destructor] (0x2000): Terminated client [0xf7e120][24] (Mon Sep 26 16:43:12 2016) [sssd[nss]] [client_destructor] (0x2000): Terminated client [0xf840e0][23] (Mon Sep 26 16:43:12 2016) [sssd[nss]] [client_destructor] (0x2000): Terminated client [0xf7b500][22] Corresponding AD log for same period: (Mon Sep 26 16:43:10 2016) [sssd[be[MYDOMAIN]]] [sbus_dispatch] (0x4000): dbus conn: 0x142aa90 (Mon Sep 26 16:43:10 2016) [sssd[be[MYDOMAIN]]] [sbus_dispatch] (0x4000): Dispatching. (Mon Sep 26 16:43:10 2016) [sssd[be[MYDOMAIN]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.service.ping on path /org/freedesktop/sssd/service (Mon Sep 26 16:43:10 2016) [sssd[be[MYDOMAIN]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_remove_watch] (0x2000): 0x1440c50/0x143e080 (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_remove_watch] (0x2000): 0x1440c50/0x143e030 (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_dispatch] (0x4000): dbus conn: 0x143eb00 (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching. (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [be_client_destructor] (0x0400): Removed SUDO client (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_remove_watch] (0x2000): 0x1444030/0x14420b0 (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_remove_watch] (0x2000): 0x1444030/0x1442060 (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_dispatch] (0x4000): dbus conn: 0x1443250 (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching. (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [be_client_destructor] (0x0400): Removed PAM client (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_remove_watch] (0x2000): 0x143d070/0x142c0d0 (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_remove_watch] (0x2000): 0x143d070/0x142aeb0 (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_dispatch] (0x4000): dbus conn: 0x143c570 (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching. (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [be_client_destructor] (0x0400): Removed NSS client (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [be_ptask_destructor] (0x0400): Terminating periodic task [SUDO Smart Refresh] (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [be_ptask_destructor] (0x0400): Terminating periodic task [SUDO Full Refresh] (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sdap_handle_release] (0x2000): Trace: sh[0x14f9ff0], connected[1], ops[(nil)], ldap[0x1449c10], destructor_lock[0], release_memory[0] (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [remove_connection_callback] (0x4000): Successfully removed connection callback. (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [sbus_remove_watch] (0x2000): 0x142f250/0x1417480 (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [remove_socket_symlink] (0x4000): The symlink points to [/var/lib/sss/pipes/private/sbus-dp_MYDOMAIN.11328] (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [remove_socket_symlink] (0x4000): The path including our pid is [/var/lib/sss/pipes/private/sbus-dp_MYDOMAIN.11328] (Mon Sep 26 16:43:12 2016) [sssd[be[MYDOMAIN]]] [remove_socket_symlink] (0x4000): Removed the symlink AD controllers are WIN2012R2 SSSD is configured with a single domain (MYDOMAIN) ######begin sssd.conf (redacted)##### [sssd] config_file_version = 2 services = nss, pam, sudo domains = MYDOMAIN debug_level = 9 [nss] default_shell = /bin/bash debug_level = 9 filter_users = root filter_groups = root [pam] debug_level = 9 [sudo] debug_level = 9 [domain/MYDOMAIN] id_provider = ldap access_provider = simple cache_credentials = false debug_level = 9 ldap_server = _srv_ ldap_search_base = ######### ldap_id_use_start_tls = true ldap_tls_reqcert = allow ldap_default_bind_dn = ######### ldap_default_authtok_type = password ldap_default_authtok = ######### ldap_user_search_base = ou=BusinessUnits,dc=mydomain ldap_user_object_class = user ldap_id_mapping = true ldap_schema = ad ldap_group_search_base = ######### ldap_group_object_class = group ldap_referrals = false enumerate = false override_homedir = /export/home/%u ldap_group_nesting_level = 5 ldap_use_tokengroups = false simple_allow_groups = sasi,sasadmin,sasmgt ldap_access_order = expire ldap_account_expire_policy = ad ######end sssd.conf##### This document is strictly confidential and is intended for use by the addressee unless otherwise indicated. Allied Irish Banks AIB and AIB Group are registered business names of Allied Irish Banks p.l.c. Allied Irish Banks, p.l.c. is regulated by the Central Bank of Ireland. Registered Office: Bankcentre, Ballsbridge, Dublin 4. Tel: + 353 1 6600311; Registered in Ireland: Registered No. 24173. ~~~~~~~Please consider the environment before printing this Email~~~~~~~~ This email has been scanned by an external Email Security System. This Disclaimer has been generated by CMDis

3 10

Question about AD authentication and trusts
by Guy Knights 21 Nov '16

21 Nov '16

Hi, Can anyone confirm for me if SSSD supports authentication of users belonging to a trusted domain via an AD controller in the trusting domain? ie. A user attempts to log in as fred(a)test1.example.com on a client machine running SSSD, where SSSD has joined a domain test2.example.com and there is a 2-way forest trust between both domains. Is this supported? I've been trying to do so and so far it hasn't been working. For the record, my setup is: AD controller domain test1: Windows server 2012 R2 AD controller domain test2: Windows server 2012 R2 Ubuntu 14.04 client running SSSD 1.12.5 Thanks, Guy

3 2

sssd.conf and /var/lib/sss/db/config.ldb
by Daniel Hermans 09 Nov '16

09 Nov '16

Hi, not sure if a bug or not but a quick warning that hopefully may save someone some time! We use puppet to install sssd based on a condition. we: - yum install -y sssd - authconfig --enablesssd --enablesssdauth --enablelocauthorize --enableldap --enableldapauth --enablemkhomedir --enablecachecreds --update ( to setup PAM and nsswitch - not sure if ALL of these are necessary? ) - copy over our private config ( as you can't do all of the config with authconfig that i can see? ) This didn't work - intermittently sssd was using a 'stale' config. After much headbutting issue was twofold: - sssd is started and activated by the authconfig command, this creates config.ldb and cache_default.ldb - puppet writes the config file immediately and sssd restarted - sssd compares modification time of /etc/sssd/sssd.conf with /var/lib/sss/db/config.ldb and, because the times are the same ( written in the same minute ), IT IGNORES the new config file Solution: - add a '--nostart' to the authconfig to stop the initial start, this will prevent creation of the cache. Copy over the config and then start/enable ( which will create the cache ). Not sure if related but there is a TODO in the code around this area (src/confdb/confdb_setup.c) ret = sss_ini_get_mtime(init_data, sizeof(timestr), timestr); if (ret <= 0 || ret >= (int)sizeof(timestr)) { DEBUG(SSSDBG_FATAL_FAILURE, "Failed to convert time_t to string ??\n"); ret = errno ? errno : EFAULT; } /* FIXME: Determine if the conf file or any snippet has changed * since we last updated the confdb or if some snippet was * added or removed. */ Puppet then

3 6

Announcing SSSD 1.14.2
by Jakub Hrozek 07 Nov '16

07 Nov '16

=== SSSD 1.14.2 === The SSSD team is proud to announce the release of version 1.14.2 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * Several more regressions caused by cache refactoring to use qualified names internally were fixed, including a regression that prevented the krb5_map_user option from working correctly. * A regression when logging in with a smart card using the GDM login manager was fixed * SSSD now removes the internal timestamp on startup cache when the persistent cache is removed. This enables admins to follow their existing workflow of just removing the persistent cache and start from a fresh slate * Several fixes to the sssd-secrets responder are present in this release * A bug in the autofs responder that prevented automounter maps from being returned when sssd_be was offline was fixed * A similar bug in the NSS responder that prevented netgroups from being returned when sssd_be was offline was fixed * Disabling the netlink integration can now be done with a new option disable_netlink. Previously, the netlink integration could be disabled with a sssd command line switch, which is being deprecated in this release. * The internal watchdog no longer kills sssd processes in case time shifts during sssd runtime * The fail over code is able to cope with concurrent SRV resolution requests better in this release * The proxy provider gained a new option proxy_max_children that allows the administrator to control the maximum number of child helper processes that authenticate users with auth_provider=proxy * The InfoPipe D-Bus responder exports the UUIDs of user and group objects through a uniqueID property == Packaging Changes == * The private pipe directory permissions were changed from 0700 to 0750. The restrictive permissions we causing SELinux dac_override denials * The Python packages for python2 were renamed from python-package to python2-package with backwards-compatible Provides and Obsoletes * The sssd-common subpackage contains a new manual page sssd-secrets(5) * The sssd-tools subpackage explicitly Requires /sbin/service on platforms that don't support systemd in order to be able to restart sssd from the sssctl tool == Documentation Changes == * The kill_service option that was no longer useful after we moved from in-process pings to watchdog was removed * The --disable-netlink sssd(8) command-line option was removed in favor of [sssd] section option disable_netlink * The proxy_max_children option was added. Please see the highlights section for more details. * The sssd-secrets responder gained a man page in this release. * Two new options containers_nest_level and max_secrets options were added to the sssd-secrets responder. The former allows the administrator to configure the maximum nesting level of secrets containers, the latter allows the administrator to configure the maximum number of secrets that can be stored. Please note that both option apply to the local secrets provider only. * The sssd-ldap man page didn't specify different default for user and group name LDAP attribute default for the AD provider. This documentation bug was fixed. == Tickets Fixed == https://fedorahosted.org/sssd/ticket/2813 man page for sss_override command provides irrelevant information for --debug option https://fedorahosted.org/sssd/ticket/2841 sssd stores and returns incorrect information about empty netgroup (ldap-server: 389-ds) https://fedorahosted.org/sssd/ticket/3051 Move the diag_cmd option so that it's usable by the watchdog. https://fedorahosted.org/sssd/ticket/3052 Remove the no longer used kill_service command https://fedorahosted.org/sssd/ticket/3053 The sssd-secrets responder needs a manpage https://fedorahosted.org/sssd/ticket/3054 Create integration tests for the sssd-secrets responder https://fedorahosted.org/sssd/ticket/3056 The sssctl tool should restart the service with systemd's dbus API https://fedorahosted.org/sssd/ticket/3107 Python SSSD Config API deletes an item during iteration https://fedorahosted.org/sssd/ticket/3123 Netgroup resolution doesn't work offline https://fedorahosted.org/sssd/ticket/3125 secrets responder throws an internal error when trying to delete a non-existent secret https://fedorahosted.org/sssd/ticket/3127 SSSD qualifies principal twice in IPA-AD trust if the principal attribute doesn't exist on the AD side https://fedorahosted.org/sssd/ticket/3128 throw away the timestamp cache if re-initializing the persistent cache https://fedorahosted.org/sssd/ticket/3134 sssd is not able to authenticate with alias https://fedorahosted.org/sssd/ticket/3137 secrets: creating a secret in a container doesn't work https://fedorahosted.org/sssd/ticket/3140 autofs map resolution doesn't work offline https://fedorahosted.org/sssd/ticket/3142 expose disabling the netlink support as a sssd.conf option https://fedorahosted.org/sssd/ticket/3143 selinux avc denial for vsftp login as ipa user https://fedorahosted.org/sssd/ticket/3145 Update sssd-sudo man page to reflect native sudo support https://fedorahosted.org/sssd/ticket/3154 sssd exits if clock is adjusted backwards after boot https://fedorahosted.org/sssd/ticket/3163 resolving IPA nested user group is broken in 1.14 https://fedorahosted.org/sssd/ticket/3165 login using gdm calls for gdm-smartcard when smartcard authentication is not enabled https://fedorahosted.org/sssd/ticket/3167 SECRETS: Deleting a container that has children should fail https://fedorahosted.org/sssd/ticket/3168 secrets: Add a configurable depth limit for containers https://fedorahosted.org/sssd/ticket/3172 Access denied for user when access_provider = krb5 is set in sssd.conf https://fedorahosted.org/sssd/ticket/3173 unable to create group in sssd cache https://fedorahosted.org/sssd/ticket/3174 Clock skew makes SSSD return System Error https://fedorahosted.org/sssd/ticket/3175 sss_groupshow does not work https://fedorahosted.org/sssd/ticket/3178 unable to add local user in sssd to a group in sssd https://fedorahosted.org/sssd/ticket/3179 sss_override fails to export https://fedorahosted.org/sssd/ticket/3180 sss_cache -r option does not print error message if more than one argument is supplied https://fedorahosted.org/sssd/ticket/3181 libwbclient-sssd: update interface to version 0.13 https://fedorahosted.org/sssd/ticket/3184 sss_groupshow <user> fails with error "No such group in local domain. Printing groups only allowed in local domain" https://fedorahosted.org/sssd/ticket/3185 SSSD goes offline when the LDAP server returns sizelimit exceeded https://fedorahosted.org/sssd/ticket/3188 krb5_map_user doesn't seem effective anymore https://fedorahosted.org/sssd/ticket/3194 [RFE] Make GETSIDBYNAME and GETORIGBYNAME request aware of UPNs and aliases https://fedorahosted.org/sssd/ticket/3205 Typo In SSSD-AD Man Page https://fedorahosted.org/sssd/ticket/3207 SSSD logs error upon adding [secrets] section. https://fedorahosted.org/sssd/ticket/3212 secrets: 500 internal server error when proxy is defined but not running https://fedorahosted.org/sssd/ticket/3213 IPA: Uninitialized variable during subdomain check == Detailed Changelog == Fabiano Fidêncio (24): * PROXY: Use the fqname when converting to lowercase * SYSDB: Rework sysdb_cache_connect() * SYSDB: Remove the timestamp cache for a newly created cache * SECRETS: Return ENOENT when_deleting a non-existent secret * PROXY: Remove lowercase attribute from save_user() * PROXY: Remove cache_timeout attribute from save_user() * PROXY: Remove cache_timeout attribute from save_group() * PROXY: Mention that save_user()'s parameters are already qualified * PROXY: Share common code of save_{group,user}() * BUILD: Add a few more targets for intg tests * BUILD: Clean up prerelease targets * BUILD: Fix typo in intgcheck-run rule * MONITOR: Remove leftovers from diag_cmd * MONITOR: Remove leftovers from kill_service * SECRETS: Search by the right type when checking containers * SECRETS: Don't remove a container when it has children * CONFIG: Add secrets responder to the allowed sections * CONFIG: Add secrets provider options * SECRETS: Make functions from local.c static * SECRETS: Use a tmp_context on local_db_check_containers() * SECRETS: Add a configurable depth limit for nested containers * SECRETS: Add a configurable limit of secrets that can be stored * TESTS: Remove a leftover debug message * TESTS: Fix check for py bindings in dlopen tests Jakub Hrozek (35): * Updating the version for the 1.14.2 release * CONFIG: selinux_provider is a valid provider type * CONFIG: session_provider does not exist anymore * IPA: Parse qualified names when guessing AD user principal * MONITOR: Remove the no longer used diag_cmd command * MONITOR: Remove the no longer used kill_service command * WATCHDOG: define and use _MAX_TICKS as 3 * SECRETS: Make internal function static * SECRETS: Make reading the config options more uniform * netlink: Don't define USE_GNU * MAN: Document the ldap_user_primary_group option * TOOLS: Fix a typo in groupadd() * KRB5: Send the output username, not internal fqname to krb5_child * KRB5: Return ERR_NETWORK_IO on clock skew * LDAP: Return partial results from adminlimit exceeded * TESTS: Add integration tests for the sssd-secrets * AUTOFS: Fix offline resolution of autofs maps * NSS: Fix offline resolution of netgroups * TESTS: Test offline netgroups resolution * tests: Add a regression test for upstream ticket #3131 * MAN: sssd-secrets documentation * CONFIG: List allowed secrets responder options * SECRETS: Add DEBUG messages to the sssd-secrets provider * SECRETS: Use a better data type for ret * SECRETS: Fix a typo in function name * SECRETS: Use HTTP error code 504 when a proxy server cannot be reached * IPA: Initialize a boolean control value * tests: Add tests for sidbyname NSS operation * tests: Add tests for getorig by UPN NSS op * BUILD: Detect the path of the "service" executable * BUILD: Only search for service in /sbin and /usr/sbin * BUILD: Not having /sbin/service is not fatal * RPM: Require initscripts on non-systemd platforms * sssctl: Fix a typo in preprocessor macro * Updating the translations for the 1.14.2 release Justin Stephenson (4): * MONITOR: Remove --disable-netlink command-line option * MONITOR: Add disable_netlink option * MAN: sssd-sudo manual update IPA native LDAP tree support * sss_cache: improve option argument handling Lukas Slebodnik (16): * sssd_netgroup.py: Resolve nested netgroups * BUILD: Allow to read private pipes for root * SPEC: Fix typo in Summary * SYSDB: Fix uninitialized scalar variable * BUILD: Remove leftover after sysdb refactoring * PROXY: Use right name in ldap filter * SYSDB: Fix error handling in sysdb_get_user_members_recursively * DEBUG: Apend line feed to messages from libsemanage * SYSDB: Suppress warning from clang static analyser * SDAP: Fix settig paging attribute in sdap_get_generic_ext_send * Remove double semicolon at the end of line * TESTS: Add simple test for double semicolon * SSSDConfig: Do not fail with nonexisting domains/services * SPEC: Rename python packages using macro %python_provide * BUILD: intgcheck need to fail if pytest fails * CI: Remove dlopen-test from valgrind blacklist Michal Židek (12): * TOOLS: sss_groupshow did not work * TESTS: sss_groupadd/groupshow regressions * TOOLS: use internal fqdn for DN * TESTS: Test for sss_user/groupmod -a * TOOLS: sss_mc_refresh_nested_group short/fqname usage * TESTS: Add FQDN variants for some tests * TOOLS: sss_override without name override * TEST: Add regression test for ticket #3179 * TOOLS: sss_groupshow fails to show MPG * TESTS: sss_groupshow with MPG * MAN: Typo in id mapping explanation * MAN: Wrong defaults for AD provider Pavel Březina (7): * watchdog: cope with time shift * dyndns: fix typo and unify ipa with ad debug message when off * failover: proceed normally when no new server is found * sss_override: improve --debug description * man page: fix language in debug level description * sssctl: use systemd D-Bus API * sssctl: call service with absolute path Petr Cech (4): * LDAP: Fixing of removing netgroup from cache * INTG: Adding support for netgroups to ldap_ent * INTG: Tests for ldap nested netgroups * PROXY: Adding proxy_max_children option Petr Čech (5): * SYSDB: Removing of unused parameter * TESTS: Fixing of 'const' warnings in sbus tests * MAKEFILE: Fixing CFLAGS in some tests * KRB5: Fixing FQ name of user in krb5_setup() * TESTS: Adding intg. tests on nested groups Sumit Bose (8): * sdap_initgr_nested_get_membership_diff: use fully-qualified names * p11: only set PKCS11_LOGIN_TOKEN_NAME if gdm-smartcard is used * p11: return a fully-qualified name * pam_sss: check PKCS11_LOGIN_TOKEN_NAME * PAM: call free only when memory is expected to be allocated * nss: allow UPNs in SSS_NSS_GETSIDBYNAME and SSS_NSS_GETORIGBYNAME * libwbclient-sssd: update interface to version 0.13 * LDAP: Removing of member link from group Thomas Equeter (1): * IFP: expose user and group unique IDs through DBus

4 9

LDAP TLS problem
by c.haul＠web.de 31 Oct '16

31 Oct '16

Hi all, I'm failing to setup TLS to OpenLDAP correctly. Running ldapsearch -x -ZZ -h cube.fritz.box -b dc=fritz,dc=box works. However, sssd_fritz.box.log contains (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [sdap_sys_connect_done] (0x0100): Executing START TLS (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [sdap_connect_done] (0x0080): START TLS result: Success(0), (null) (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [sdap_cli_connect_recv] (0x0400): Connection established. (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'cube.fritz.box' as 'working' (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [set_server_common_status] (0x0100): Marking server 'cube.fritz.box' as 'working' (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [fo_set_port_status] (0x0400): Marking port 389 of duplicate server 'cube.fritz.box' as 'working' (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [dc=fritz,dc=box] (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uidNumber=11012)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][dc=fritz,dc=box]. (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [5]: Eingabe-/Ausgabefehler (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [sdap_get_users_done] (0x0040): Failed to retrieve users [5][Eingabe-/Ausgabefehler]. (Sun Oct 30 21:49:40 2016) [sssd[be[fritz.box]]] [sdap_id_op_done] (0x0200): communication error on cached connection, moving to next server Config is [domain/fritz.box] id_provider = ldap debug_level = 6 ldap_schema = rfc2307 enumerate = false ldap_uri = ldap://cube.fritz.box ldap_search_base = dc=fritz,dc=box ldap_access_filter = memberOf=cn=users,ou=Group,dc=fritz,dc=box ldap_tls_cacert = /etc/ssl/certs/Local_ROOT_CA.crt ldap_tls_reqcert = demand ldap_id_use_start_tls = True # file /etc/ssl/certs/Local_ROOT_CA.crt /etc/ssl/certs/Local_ROOT_CA.crt: PEM certificate # cat /etc/ldap/ldap.conf BASE dc=fritz,dc=box URI ldaps://cube.fritz.box SSL start_tls TLS_CACERT /etc/ssl/certs/Local_ROOT_CA.crt TLS_REQCERT demand All indicates that SSSD terminates the connection. OpenLDAP log: Oct 30 21:49:40 cube slapd[14620]: conn=1289 fd=20 ACCEPT from IP=192.168.254.13:55698 (IP=0.0.0.0:389) Oct 30 21:49:40 cube slapd[14620]: conn=1289 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 30 21:49:40 cube slapd[14620]: conn=1289 op=0 STARTTLS Oct 30 21:49:40 cube slapd[14620]: conn=1289 op=0 RESULT oid= err=0 text= Oct 30 21:49:40 cube slapd[14620]: conn=1289 fd=20 closed (TLS negotiation failure) Oct 30 21:49:40 cube slapd[14620]: conn=1290 fd=20 ACCEPT from IP=192.168.254.13:55700 (IP=0.0.0.0:389) Oct 30 21:49:40 cube slapd[14620]: conn=1290 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 30 21:49:40 cube slapd[14620]: conn=1290 op=0 STARTTLS Oct 30 21:49:40 cube slapd[14620]: conn=1290 op=0 RESULT oid= err=0 text= Oct 30 21:49:40 cube slapd[14620]: conn=1290 fd=20 closed (TLS negotiation failure) Wireshark says: - correct certificate is presented by OpenLDAP - clients sends Secure Sockets Layer TLSv1.2 Record Layer: Alert (Level: Warning, Description: Close Notify) Content Type: Alert (21) Version: TLS 1.2 (0x0303) Length: 2 Alert Message Level: Warning (1) Description: Close Notify (0) Increasing debug_level doesn't provide more details. This is on debian sid with # dpkg -l sssd ii sssd 1.14.1-1 amd64 System Security Services Daemon -- metapackage How to proceed? How to find out more what's wrong with the TLS setup? TIA, Chris.

2 2

Joining AD with adcli, strange error
by Joakim Tjernlund 28 Oct '16

28 Oct '16

The other day I tried to join a machine using adcli and during the join I got some strange error msg about not finding: _ldap._tcp.._sites.dc._msdcs.infinera.com Notice the .. between _tcp and _sites, this is not a valid DNS domain, how did this happen? Jocke

3 10

Apache web server and Active Directory domain authorization with SSSD (with SSO)
by Aleksey Maksimov 26 Oct '16

26 Oct '16

Hello SSSD guru`s! Is there anyone have such experience? There may be some recommendations or instructions?

5 8

SSSD ad provider no ldap_id_mapping and msSFU30PosixMemberOf
by squallu＠gmail.com 25 Oct '16

25 Oct '16

hi, i'm trying to configure sssd with ad provider to work with ldap_id_mapping = False, everything is working fine except additional group aside from the primary (msSFU30PosixMemberOf), is it even possible without switching to id_provider=ldap? Adding ldap_user_member_of = msSFU30PosixMemberOf to /etc/sssd/sssd.conf changes nothing, switching to id_provider = ldap works and gives me back all the unix groups configured on AD. Thank you.

2 2

full_name_format and supplemental groups
by Orion Poplawski 25 Oct '16

25 Oct '16

Running IPA with an AD trust. Users are in AD. Trying to use full_name_format = %1$s to strip the domain from user names. This appears to break supplemental groups in strange ways. On the IPA server: Without full_name_format: # id orion(a)ad.nwra.com uid=470202603(orion(a)ad.nwra.com) gid=470202603(orion(a)ad.nwra.com) groups=470202603(orion(a)ad.nwra.com),470200513(domain users(a)ad.nwra.com),470204703(pirep rd users(a)ad.nwra.com),470204714(wireless access@ad.nwra.com),470204715(nwra-users@ad.nwra.com),470204701(boulder@ad.nwra.com),470207608(heimdall users(a)ad.nwra.com),470200512(domain admins(a)ad.nwra.com),470207124(andreas admins(a)ad.nwra.com) With: # id orion(a)ad.nwra.com uid=470202603(orion) gid=470202603(orion) groups=470202603(orion) If I add: default_domain_suffix = ad.nwra.com # id orion uid=470202603(orion) gid=470202603(orion) groups=470202603(orion),470200512(domain admins),470207608(heimdall users),470204714(wireless access),470204715(nwra-users),470204701(boulder),470204703(pirep rd users),470207124(andreas admins),470200513(domain users) Which I guess makes some sense as you'd need to add the domain suffix back on to find the groups. But this appears to completely break IPA clients (with full_name_format = %1$s and default_domain_suffix = ad.nwra.com) # id orion(a)ad.nwra.com id: orion(a)ad.nwra.com: no such user # id orion id: orion: no such user >From looking at the server logs, it looks like only the IPA domain is searched If I reset the server back to normal (drop full_name_format and default_domain_suffix): # id orion uid=470202603(orion) gid=470202603(orion) groups=470202603(orion) I don't get any supplemental groups. I see sssd errors like: (Mon Mar 30 15:20:52 2015) [sssd[be[nwra.com]]] [sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory) (Mon Mar 30 15:20:52 2015) [sssd[be[nwra.com]]] [sysdb_update_members_ex] (0x0020): Could not add member [orion] to group [name=domain admins,cn=groups,cn=nwra.com,cn=sysdb]. Skipping. Is t trying "cn=groups,cn=nwra.com,cn=sysdb" instead of "cn=groups,cn=ad.nwra.com,cn=sysdb" -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

3 7

sssd sudo issue
by Mario Rossi 24 Oct '16

24 Oct '16

Hi sssd-users list, I am facing a strange issue on several CentOS servers. It seems that after a while ( days ) sudo does not work any more for some of my users. We keep rudo rules in OpenLDAP. If a user uses 'sudo su - ' , he gets a an error message ( "User abc is not allowed to run sudo on ....") however if he user runs 'id' followed by 'sudo su -' then in some of the cases, it works fine, user can get root access. I even upgraded to the unofficial repo hoping that the issue we see is similar/same to https://fedorahosted.org/sssd/ticket/2970. But I think it's a different issue. Any ideas? Next I will be looking at dumping the local sssd cache files. I can provide debug =9 log files offline if needed. Thank you root@server yum.repos.d # rpm -qa | egrep sssd sssd-common-pac-1.13.4-4.el6.x86_64 sssd-ldap-1.13.4-4.el6.x86_64 sssd-tools-1.13.4-4.el6.x86_64 sssd-client-1.13.4-4.el6.x86_64 sssd-ad-1.13.4-4.el6.x86_64 python-sssdconfig-1.13.4-4.el6.noarch sssd-common-1.13.4-4.el6.x86_64 sssd-ipa-1.13.4-4.el6.x86_64 sssd-proxy-1.13.4-4.el6.x86_64 sssd-krb5-common-1.13.4-4.el6.x86_64 sssd-krb5-1.13.4-4.el6.x86_64 sssd-1.13.4-4.el6.x86_64 root@server sssd # vim /etc/sssd/sssd.conf # set debug = 9 root@server sssd # sudo -U abc -l* **User abc is not allowed to run sudo on **server**.* root@server sssd # egrep sudo /etc/nsswitch.conf sudoers: sss root@server sssd # ip a s dev eth0 | egrep global inet 216.X.Y.Z/26 brd 216.X.Y.Z scope global eth0 root@server sssd # id abc uid=100001044(abc) gid=1009(...) groups=1202(...),1168(...),1191(...),1102(...),1009(...),1101(...),1127(...),1167(...),1111(...),1178(...),1109(...),1199(...),1208(stage),1117(...),1198(...),1192(...),1206(...),1176(...),1404(...),1183(...),1103(...),1110(...),1205 root@abc sssd # sudo -U abc -l Matching Defaults entries for abc on this host: [...] *User **abc**may run the following commands on this host:** ** (ALL) PASSWD: ALL* # LDAP Sudo def dn: cn=stage,ou=sudoers,o=Domain,dc=domain,dc=com sudoOrder: 42 [...] sudoUser: %stage sudoRunAs: ALL cn: stage description: Allow Trusted Senior stuff become root sudoCommand: ALL sudoHost: 216.X.Y.Z [...] objectClass: top objectClass: sudoRole sudoOption: authenticate # Group def dn: cn=stage,ou=groups,o=Domain,dc=domain,dc=com gidNumber: 1208 cn: stage description: stage Group objectClass: posixGroup objectClass: top memberUid: abc hMemberDN: uid=abc,ou=users,o=Domain,dc=domain,dc=com Sanitized sssd.conf: [sssd] config_file_version = 2 sbus_timeout = 30 services = nss, pam, sudo, ssh domains = LOCAL, DOMAIN1, DOMAIN2 [nss] filter_users = adm,apache,avahi,bin,daemon,dbus,ecryptfs,ftp,git,games,gopher,haldaemon,halt,hfallback,ldap,lp,mail,mailnull,named,news,nfsnobody,nobody,nscd,nslcd,ntp,operator,oprofile,ossec,postfix,puppet,puppet-dashboard,pulse,pulse-access,radiusd,root,rpc,rpcuser,rtkit,saslauth,sfallback,shutdown,slocate,smmsp,sshd,sync,tcpdump,tss,uucp,vcsa filter_groups = adm,apache,audio,bin,cdrom,cgred,daemon,dbus,dialout,dip,disk,ecryptfs,floppy,fuse,git,hfallback,kmem,ldap,lock,lp,mail,mailnull,man,mem,nfsnobody,nobody,nscd,ntp,ossec,oprofile,postdrop,postfix,puppet,puppet-dashboard,pulse,pulse-access,root,rpc,rpcuser,rtkit,saslauth,sfallback,slocate,smmsp,sshd,sys,tape,tcpdump,tss,tty,users,utempter,utmp,vcsa,video override_shell = /bin/bash [pam] debug_level = 3 reconnection_retries = 3 offline_credentials_expiration = 2 offline_failed_login_attempts = 3 offline_failed_login_delay = 5 pam_verbosity = 1 pam_pwd_expiration_warning = 21 pam_account_expired_message = Account expired, please use selfservice portal to change your password and extend account. [sudo] debug_level=9 [ssh] # debug_level=9 [domain/LOCAL] description = LOCAL Users domain id_provider = local enumerate = true min_id = 500 max_id = 999 default_shell = /bin/bash base_directory = /home create_homedir = false remove_homedir = true homedir_umask = 077 skel_dir = /etc/skel mail_dir = /var/spool/mail ######### SECTION: DOMAIN1 [domain/DOMAIN1] min_id = 499 debug_level = 9 cache_credentials = True entry_cache_timeout = 864000 auth_provider = ldap id_provider = ldap access_provider = ldap #chpass_provider = ldap sudo_provider = ldap selinux_provider = none autofs_provider = none # LDAP Search ldap_search_base = dc=domain,dc=com ldap_group_search_base = ou=groups,o=Domain,dc=domain,dc=com ldap_user_search_base = ou=users,o=Domain,dc=domain,dc=com?subtree?(|(description=cn=stage,ou=groups,o=Domain,dc=domain,dc=com)(.....)(.....)) # LDAP Custom Schema ldap_group_member = hMemberDN ldap_user_member_of = description # this should really be rfc2307 ldap_schema = rfc2307bis ldap_network_timeout = 3 ldap_id_use_start_tls = False ldap_tls_reqcert = never ldap_tls_cacertdir = /etc/openldap/cacerts ldap_uri = ldaps://s1.sec.domain.com, ldaps://s2.sec.domain.com, ldaps://s3.sec.domain.com ldap_backup_uri = ldaps://66.X.Y.Z ldap_default_authtok_type = obfuscated_password ldap_default_bind_dn = uid=MYDN ldap_default_authtok = MYPASS ldap_user_ssh_public_key = sshPublicKey ldap_pwd_policy = none ldap_account_expire_policy = shadow ldap_user_shadow_expire = shadowExpire # shadowExpire: days since Jan 1, 1970 that account is disabled: $ echo $(($(date --utc --date "$1" +%s)/86400)) ldap_chpass_update_last_change = false ldap_access_order = filter, expire ldap_access_filter = (&(objectClass=posixAccount)(uidNumber=*)(hAccountInitialSetup=1)(|(description=cn=stage,ou=groups,o=Domain,dc=domain,dc=com))) # SUDO ldap_sudo_search_base = ou=sudoers,o=Domain,dc=domain,dc=com ldap_sudo_full_refresh_interval = 86400 ldap_sudo_smart_refresh_interval = 3600 #entry_cache_sudo_timeout = 5400 The same options for DOMAIN2 except filters and user/group base. hMemberDN is defined in nis.schema, a relic of OpenLDAP 2.2, a workaround applied before transitioning to 2.4.40. # Modification to posixGroup attributetype ( 1.3.6.1.1.1.1.28 NAME 'hMemberDN' DESC 'RFC2256: member of a group' SUP distinguishedName ) objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ hMemberDN $ description ) ) hMemberDN: uid=abc,ou=users,o=Domain,dc=domain,dc=com

2 3

sssd + LDAP: NSS works, PAM: Can't contact LDAP server
by Sascha Frey 24 Oct '16

24 Oct '16

Hi list, I have some trouble with sssd after upgrading from Debian Jessie (stable) to Stretch (testing). I'm using sssd with LDAP (OpenLDAP servers running Debian Jessie) for NSS and PAM. NSS works just fine. getent passwd|group does return all users and groups stored in LDAP. PAM doesn't work. I get this error in the log: [sssd[be[LDAP]]] [fo_set_port_status] (0x0400): Marking port 389 of duplicate server 'ldap2.Domain.TLD' as 'working' [sssd[be[LDAP]]] [simple_bind_send] (0x0100): Executing simple bind as: uid=someuser,ou=user,dc=Sub,dc=Domain,dc=TLD [sssd[be[LDAP]]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] /var/log/auth.log: sshd[13510]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.200.11 user=someuser sshd[13510]: pam_sss(sshd:auth): received for user someuser: 4 (System error) Old version: 1.11.7-3 (Debian) New version: 1.14.1-1 (Debian) I'm pretty sure that the connection to the LDAP server does work for NSS. After stopping sssd, deleting /var/lib/sss/db/* and starting sssd again it does fetch all users and groups from the directory. Any idea what's wrong? Cheers, Sascha

2 1

SSSD Caching Question
by Douglas Duckworth 24 Oct '16

24 Oct '16

Hello, I am in the process of deploying a new LDAP cluster. Y'all were very helpful in getting SSSD configured properly. We were doing not using SSSD at all before. That really freaks me out, given we have all of our NFS mounts defined in LDAP, so consequently I have added autofs. Our LDAP schema does not conform to any "standard" so I have attached my sanitized sssd.conf and autofs.conf, as well as nsswitch.conf, in case anyone had issues doing autofs and sssd with aliases. Eg: # autofs.maps, server, machines, blah.blah.blah.blah dn: ou=autofs.maps,cn=server,ou=machines,dc=blah,dc=blah,dc=blah,dc=blah ou: autofs.maps objectClass: automountMap objectClass: top # scratch, autofs.maps, server, machines, blah.blah.blah.blah dn: cn=scratch,cn=server,ou=machines,dc=blah,dc=blah,dc=blah,dc=blah ou: autofs.maps cn: scratch objectClass: alias objectClass: extensibleObject aliasedObjectName: ou=scratch,ou=autofs.maps,dc=blah,dc=blah,dc=blah,dc=bla h # scratch, autofs.maps, davinci.med.cornell.edu dn: ou=scratch,ou=autofs.maps,dc=dc=blah,dc=blah,dc=blah,dc=bla h objectClass: top objectClass: organizationalUnit ou: scratch # 31337lab_scratch, scratch, autofs.maps, blah.blah.blah.blah dn: cn=fclab_scratch,ou=scratch,ou=autofs.maps,dc=blah,dc=blah,dc=blah,dc=bla h cn: 31337lab_scratch objectClass: automount automountInformation: exporting.nfs.server:/important/stuff/located/here "ldap_deref = always" made this work. Anyway, hope someone finds that useful. So caching. Would such a long LDAP caching policy, shown in my sssd.conf, have any downsides? I thought the longer the better though what if users change their password? Does sssd poll LDAP server for changes in order to make sure the cache doesn't fall behind state present in LDAP? Best Doug Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-5454 F: 212-746-8690

2 1

Please help me, setting up smartcard auth against Active Directory
by niger niger 21 Oct '16

21 Oct '16

I seting up fedora (24), using wiki. https://fedorahosted.org/sssd/wiki/DesignDocs/SmartcardAuthenticationTestin… Every thing going ok, and i can use login and password. But if i'll try to use smart card, nothing hapent in gdm logon screen. pkcs11-tool --module my_pkcs11_module.so --slot 0 --list-objects -l ask my pin, and after show my certs and keys /usr/libexec/sssd/p11_child --pre -d 10 --debug-fd=2 --nssdb=/etc/pki/nssdb return public key of my cert. /etc/pam.d/smartcard-auth-ac auth sufficient pam_sss allow_missing_name in log, cant see any intresting about inserting my token.

2 14

Active Directory domain authorization on CentOS 7.2 servers with SSSD
by Aleksey Maksimov 20 Oct '16

20 Oct '16

Hello SSSD guru`s! I want to set up Active Directory domain authorization in my CentOS 7.2 servers with SSSD. For this I use SSSD as described here: https://blog.it-kb.ru/2016/10/15/join-debian-gnu-linux-8-6-to-active-direct… I have set up for several servers and everything works well. But on the last one server SSSD does not work as they should. I attached this server to the domain using the realm utility. It looks nice. [root@KOM-OVIRT1 ~]# realm list ad.holding.com type: kerberos realm-name: AD.HOLDING.COM domain-name: ad.holding.com configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common login-formats: %U(a)ad.holding.com login-policy: allow-permitted-logins permitted-logins: permitted-groups: KOM-SRV-Linux-Admins(a)ad.holding.com However, getent does not return information about domain accounts: [root@KOM-OVIRT1 ~]# getent passwd aleksey(a)ad.holding.com [root@KOM-OVIRT1 ~]# getent for local accounts work: [root@KOM-OVIRT1 ~]# getent passwd root root:x:0:0:root:/root:/bin/bash My /etc/sssd/sssd.conf: ------------------------------------------------ [sssd] domains = ad.holding.com config_file_version = 2 services = nss, pam default_domain_suffix = ad.holding.com [nss] debug_level=9 [domain/ad.holding.com] ad_server = kom-dc01.ad.holding.com, kom-dc02.ad.holding.com ad_domain = ad.holding.com krb5_realm = AD.HOLDING.COM realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = ad debug_level=9 ------------------------------------------------ /var/log/sssd/sssd_nss.log: (Wed Oct 19 16:54:44 2016) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [ad.holding.com][4097][1][name=aleksey] (Wed Oct 19 16:54:44 2016) [sssd[nss]] [sbus_add_timeout] (0x2000): 0x7f8794b5f9a0 (Wed Oct 19 16:54:44 2016) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x7f8792bce0d0:1:aleksey@ad.holding.com] (Wed Oct 19 16:54:44 2016) [sssd[nss]] [sbus_remove_timeout] (0x2000): 0x7f8794b5f9a0 (Wed Oct 19 16:54:44 2016) [sssd[nss]] [sbus_dispatch] (0x4000): dbus conn: 0x7f8794b5b120 (Wed Oct 19 16:54:44 2016) [sssd[nss]] [sbus_dispatch] (0x4000): Dispatching. (Wed Oct 19 16:54:44 2016) [sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 1 errno: 11 error message: Fast reply - offline (Wed Oct 19 16:54:44 2016) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider Error: 1, 11, Fast reply - offline Will try to return what we have in cache (Wed Oct 19 16:54:44 2016) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x7f8792bce0d0:1:aleksey@ad.holding.com] ------------------------------------------------ /var/log/sssd/sssd_ad.holding.com.log (Wed Oct 19 16:53:21 2016) [sssd[be[ad.holding.com]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=aleksey] (Wed Oct 19 16:53:21 2016) [sssd[be[ad.holding.com]]] [be_get_account_info] (0x0100): Request processed. Returned 1,11,Fast reply - offline What could be the problem?

3 10

ding-libs repo on Github is out of date
by Petr Spacek 17 Oct '16

17 Oct '16

Hello, I just noticed that Github repo https://github.com/SSSD/ding-libs/commits/master is way out of date, with last commit from 2014. https://git.fedorahosted.org/cgit/ding-libs.git/log/ contains much newer things. Can we either set up synchronization of these two, or remove the outdated one? Thanks! -- Petr Spacek @ Red Hat

2 2

Question about FreeIPA covered at https://lists.fedorahosted.org/archives/list/devel@lists.fedoraproject.org/2015/12/
by Gerard Blokdijk 14 Oct '16

14 Oct '16

Hello Sssd, I was searching for FreeIPA information and I came across https://lists.fedorahosted.org/archives/list/devel@lists.fedoraproject.org/…, where you cover FreeIPA. FreeIPA is included in the current Auth0 predictive analytics report at https://theartofservice.com/Auth0-predictive-analytics-report.html Because I feel this is of interest to you, and to find mutual ground, I want to give you the full $97 report for free. You can download the PDF direct here https://theartofservicelab.s3.amazonaws.com/report/Auth0%20Predictive%20Ana… What is the value of the report? I've been in many enterprise data center management and CxO roles over the past 25 years, and something simple as reports like we're producing was always the guide I missed; transparant data across many data points covering a specific topic and its related topics, highlighting what's important now and in the future - a simple way to instantly understand and move forward in the right direction, based on verifiable data. The aim of the report is to give a compass-overview of what is, and is going to be, of impact to the topic of the report - for readers who need a quick starter and insight into the topic. It is NOT meant for an expert in the field, who knows the field inside-out. The report's target audience is the manager and professional who needs quick insight into the field and where it is heading. Would you give me a bit of your time to go look at it? I'm asking this because the analysis has to win on its own right and appeal to you. It solves a lot of clients' problems and it has to be obvious to you how it would create value to you. Please feel free to use the data, including graphics, in any way. I would appreciate it if you would consider linking to https://theartofservice.com/Auth0-predictive-analytics-report.html. To make it easy you can use the following text (or use any text you like): 'The Art of Service's Auth0 predictive analytics report evaluates technologies and applications (including FreeIPA) in terms of their business impact, adoption rate and maturity level to help users decide where and when to invest.' If I can assist you with anything else, or return the favor, please let me know. Gerard Blokdijk Connect with me here: https://www.linkedin.com/in/gerardblokdijk CEO The Art of Service https://theartofservice.com gerard.blokdijk(a)theartofservice.com

2 1

User [op01] was not found with the specified filter. Denying access
by liujitao79＠gmail.com 14 Oct '16

14 Oct '16

hi,all #### user op01 ldapsearch -x -W -H ldaps://master.local -D cn=manager,dc=suntv,dc=tv -b uid=op01,ou=people,dc=suntv,dc=tv Enter LDAP Password: ``` # extended LDIF # # LDAPv3 # base <uid=op01,ou=people,dc=suntv,dc=tv> with scope subtree # filter: (objectclass=*) # requesting: ALL # # op01, people, suntv.tv dn: uid=op01,ou=people,dc=suntv,dc=tv uid: op01 cn: op01 sn: op01 objectClass: hostObject objectClass: posixAccount objectClass: shadowAccount objectClass: inetOrgPerson userPassword:: MTIzNDU2 shadowLastChange: 17085 shadowMin: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 1001 gidNumber: 2001 homeDirectory: /home/op01 labeledURI: ldaps:///ou=op,ou=host,dc=suntv,dc=tv?host # Dynamic Lists of the opneldap host: 192.168.1.21 # generated Dynamic Lists of the opneldap host: 192.168.1.22 # generated Dynamic Lists of the opneldap # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ``` ####sssd.conf ``` id_provider = ldap auth_provider = ldap chpass_provider = ldap ...... ldap_search_base = dc=suntv,dc=tv ldap_user_search_base = ou=people,dc=suntv,dc=tv ldap_group_search_base = ou=group,dc=suntv,dc=tv ...... access_provider = ldap ldap_access_order = filter ldap_access_filter = (|(host=all)(host=192.168.1.21)) ``` ####test ssh op01(a)192.168.1.21 op01(a)192.168.1.21's password: Connection to 192.168.1.21 closed by remote host. Connection to 192.168.1.21 closed. sssd_LDAP.log ``` (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_access_filter_send] (0x0400): Performing access filter check for user [op01] (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_access_filter_send] (0x0400): Checking filter against LDAP (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_print_server] (0x2000): Searching 192.168.1.11 (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=op01)(objectclass=posixAccount)(|(host=all)(host=192.168.1.21)))][uid=op01,ou=people,dc=suntv,dc=tv]. (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 5 (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_op_add] (0x2000): New operation 5 timeout 6 (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x7f1b15cca440], connected[1], ops[0x7f1b15d9a700], ldap[0x7f1b15cb09f0] (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_op_destructor] (0x2000): Operation 5 finished (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_id_op_done] (0x4000): releasing operation connection (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_access_filter_done] (0x0100): User [op01] was not found with the specified filter. Denying access. (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_access_filter_done] (0x0400): Access denied by online lookup (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x7f1b15d9da80 (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x7f1b15d9dbb0 (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [ldb] (0x4000): Running timer event 0x7f1b15d9da80 "ltdb_callback" (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [ldb] (0x4000): Destroying timer event 0x7f1b15d9dbb0 "ltdb_timeout" (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [ldb] (0x4000): Ending timer event 0x7f1b15d9da80 "ltdb_callback" (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_access_done] (0x0400): Access was denied. (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 6, <NULL>) [Success (Permission denied)] (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sending result [6][LDAP] (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sent result [6][LDAP] (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x7f1b15cca440], connected[1], ops[(nil)], ldap[0x7f1b15cb09f0] (Fri Oct 14 10:23:04 2016) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Fri Oct 14 10:23:06 2016) [sssd[be[LDAP]]] [sbus_dispatch] (0x4000): dbus conn: 0x7f1b15cac500 (Fri Oct 14 10:23:06 2016) [sssd[be[LDAP]]] [sbus_dispatch] (0x4000): Dispatching. ``` calling ldap_search_ext with [(&(uid=op01)(objectclass=posixAccount)(|(host=all)(host=192.168.1.21)))][uid=op01,ou=people,dc=suntv,dc=tv] User [op01] was not found with the specified filter. Denying access. Why is not results the ldap_search_ext? please help me, thank.

2 1

LDAP [be_resolve_server_process] and DNS change
by Thomas Hummel 13 Oct '16

13 Oct '16

Hello, When using LDAP backend with a DNS name (ldap_uri = ldap://ldap.my.domain), I noticed that when the 'A' DNS record gets modified, even if the OS resolver is getting the new ip address (command 'host ldap.my.domain' for instance), the sssd resolver [be_resolve_server_process] was still caching the old ldap ip address. It seems that a sssd restart is necessary (then, on the next request for a non cached entry, a new connexion is made to the new ip address). I didn't change 'ldap_connection_expire_timeout' which I'm not sure, by the way, to quite understand as if I grep 'Found address for server' in sssd log files, I don't see 15 min intervals. So my questions are : - is there a way to flush that cached ip (other than restarting) ? - without restart, would sssd resolver indefinitely cache the old ip address ? - why don't I see periodic 15min intervals on 'Found address' in logs ? Thanks -- Thomas HUMMEL

2 2

LDAP backend failover
by Thomas Hummel 07 Oct '16

07 Oct '16

Hello, we're about to move 2 DNS LDAP backend (openldap-2.4.40) of sssd-1.12.4 from DNS round robin to a virtual ip on a load balancer. We don't use SRV records. So the plan is to go from : ldap_uri = ldaps://ldap.dom.ain ldap.dom.ain having 2 IN A DNS records to : ldap_uri = ldaps://ldap.dom.ain where ldap.dom.ain resolves in the load balancer hosted vip. My understanding is that, in the target setup, if one of the backend is shutdown or stop responding, sssd will still wait some timeout to reconnect to the vip. So we still would have a time slice where id <user> would return no result (assuming <user> was not in the cache). So the only gain for that matter would be that we would be garantied that on the next backend connection, the backend would answer since the loadbalancer would have pointed the connection to the working one. Is there a way, other than tweaking the timout value, to avoid such no-result hole ? (and without enmumarate = true either) ? Thansk -- Thomas HUMMEL

1 1

sssd with multiple LDAP-sources to serve samba-logins
by Andreas Matthus 07 Oct '16

07 Oct '16

Hallo, yes I can use multiple LDAP-sources to local login, su and ssh. That is fine (The uid and gid are differ in all of them, so merge is possible). But I search for a solution to use the logins for samba too. The samba-mailinglist say: That is not our problem - ask sssd. So I do that ;-) Can someone help me? with regards Andreas Matthus -- Dipl.-Phys. Andreas Matthus Netzwerkadministrator Technische Universität Dresden Fakultät Architektur 01062 Dresden Tel.: +49 (351) 463-33909 Fax: +49 (351) 463-36120 E-Mail: andreas.matthus(a)tu-dresden.de

2 1

Problem with automounter
by Ondrej Valousek 07 Oct '16

07 Oct '16

Hi List, Problem - when I reboot my machine, sssd won't pick up autofs maps at the very beginning and can't even serve maps from the case - fine, that's a known problem that will be dealt with. Now the second problem - I would expect that if I leave the machine running for some time, automount will eventually start working (as SSSD would come online & serve maps). But this does not happen - waiting for a hour, but automounter still does not work. I have to manually 'service autofs reload' to make it working. Is that normal? Note I have mostly indirect maps. Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

2 7

UID collision possibility in SSSD with a mix of WindowsAD and non-AD domains?
by sambitnayak+subscribe＠gmail.com 06 Oct '16

06 Oct '16

Hi, Requesting answers to some queries. On a client system, SSSD can be configured to query identity and authenticate against multiple domains - Windows Active Directory (AD) as well as non-AD ones like LDAP store or say, FreeIPA. I understand that SSSD offers ID mapping for Windows AD objects (users, groups etc.) to offer a separate ID range/namespace for separate Windows AD domains. (1) What about non-AD domains? Can SSSD "map" separate ID ranges for different non-AD domains? That is : assume that LDAP id provider backend is used by SSSD for the two non-AD domains "abc.com" and "xyz.com". Can SSSD allot two different UIDs to user "alice(a)abc.com" and "alice(a)xyz.com" who have same UID in their respective domains? (2) And, does SSSD ensure that ID ranges for such non-AD "abc.com" and "xyz.com" will not clash with another Windows AD domain "win.com" that SSSD is configured to work with? (I think the answer is yes here, but just double checking...) Thanks & Regards, Sambit

2 1

sssd_be[30807]: ldapdb_canonuser_plug_init() failed in sasl_canonuser_add_plugin(): invalid parameter supplied after upgrading packages
by Steffen Knauf 04 Oct '16

04 Oct '16

Hello, after upgrading sssd package from 1.13.0-40.el7_2.1 to 1.13.0-40.el7_2.9 and upgrading the cyrus-sasl Packages from 2.1.26-19.2.el7 to 2.1.26-20.el7_2 i got the following Message after restarting sssd: sssd_be[30849]: ldapdb_canonuser_plug_init() failed in sasl_canonuser_add_plugin(): invalid parameter supplied sssd_be[30849]: _sasl_plugin_load failed on sasl_canonuser_init for plugin: ldapdb I don't change any configuration in sssd.conf or saslauthd.conf. Setting the relevant debug_level = 9 in sssd.conf don't help, so perhaps can give me a hint? greets Steffen

2 4

SSSD with AD and sudo (case sensitivity)
by John Beranek 04 Oct '16

04 Oct '16

Hi, I've been following Jakub's useful blog post[1], attempting to get sudo rules into our Active Directory, and usable by sudo via SSSD. I've managed the schema extension, and built a rule, but whatever I've tried I've not managed to get the rule to apply. When I run "sudo -l" as the user should have received a sudo rule I get the following: [_johnbadm@sudotest ~]$ sudo -l [sudo] password for _johnbadm: Sorry, user _johnbadm may not run sudo on sudotest. However, there *is* a rule in the SSSD db: [root@sudotest ~]# ldbsearch -H /var/lib/sss/db/cache_AD.ldb '(objectClass=sudoRule)' asq: Unable to register control with rootdse! # record 1 dn: name=lessrule,cn=sudorules,cn=custom,cn=AD,cn=sysdb cn: lessrule dataExpireTimestamp: 1475513295 entryUSN: 17309854 name: lessrule objectClass: sudoRule originalDN: CN=lessrule,OU=sudoers,DC=example,DC=com sudoCommand: /usr/bin/less sudoHost: ALL sudoHost: *.example.com sudoRunAsUser: ALL sudoUser: _johnbadm distinguishedName: name=lessrule,cn=sudorules,cn=custom,cn=AD,cn=sysdb # returned 1 records # 1 entries # 0 referrals I'm running CentOS 6.8, with SSSD 1.13.3-22.el6. [root@sudotest ~]# grep sudo /etc/nsswitch.conf sudoers: files sss [root@sudotest ~]# grep sudo /etc/sssd/sssd.conf services = nss, pam, sudo I turned on debug for the SSSD sudo service, and get: https://paste.fedoraproject.org/442892/72188147/ Just read the debug again, and had a hunch around case sensitivity... When I change the sudo rule to have: sudoUser: _johnbADM instead of: sudoUser: _johnbadm it works. Surely the matching of rules should be case insensitive, shouldn't it? The username form "_johnbADM" presumably works because the AD user's sAMAccountName is the form with the mixed case, which you can see in the SSSD DB: # record 25 dn: name=_johnbADM,cn=users,cn=AD,cn=sysdb createTimestamp: 1475573234 fullName: John Beranek ADM gecos: John Beranek ADM Thoughts? John -- John Beranek To generalise is to be an idiot. http://redux.org.uk/ -- William Blake

2 8

Using proxy for id_provider and ldap for auth_provider against AD
by Speagle, Andy 03 Oct '16

03 Oct '16

Hi Folks, I'm attempting to create a configuration whereby Active Directory is used via LDAP only to authenticate ONLY local users via a proxy id_provider using local files... this was the configuration that I was attempting: [sssd] config_file_version = 2 domains = <domain> services = nss, pam [nss] [pam] [domain/<domain>] debug_level = 9 id_provider = proxy auth_provider = ldap proxy_lib_name = files cache_credentials = true ldap_uri = <list,of,domain,controllers> ldap_id_use_start_tls = true ldap_tls_reqcert = allow ldap_default_bind_dn = <bind account> ldap_default_authtok = <bind sekrit> ldap_schema = ad ldap_search_base = <search base> -- It seems to be finding my entry just fine in /etc/passwd... but, it seems to be unable to perform the LDAP search... as I get back these sanitized results... showing that it can't find my user object... for some reason... (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [<base>] (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=<myuser>)(objectclass=user))][<base>]. (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectclass] (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName] (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 2 (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_process_result] (0x2000): Trace: sh[0xf49a70], connected[1], ops[0xf49400], ldap[0xf45cc0] (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_process_result] (0x2000): Trace: sh[0xf49a70], connected[1], ops[0xf49400], ldap[0xf45cc0] (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_done] (0x0400): Search result: Operations error(1), 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580 (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Operations error(1), 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580 (Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [5]: Input/output error -- If I perform a manual ldapsearch ... using the parameters indicated in the "ldap_search_ext" call ... it works just fine. I've checked in the logs and I see that it marks the connection to the domain controller as "working" ... so, I'm not sure why sssd complains that a successful bind must be completed... that seems to have happened already... I'm running sssd version 1.11.7 ... Any ideas, folks? Thanks, Andy Speagle

3 4

Which SSSD-version against which AD-level?
by Roger Mårtensson 03 Oct '16

03 Oct '16

Hi! Trying to find a page that describes against what Active Directory versions the LTM (1.13) and 1.14 is supporting. My Google-fu isn't giving me anything. Does it work with the just release GA of Windows and Active Directory? Yours, Roger

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users October 2016