LDAP [be_resolve_server_process] and DNS change
by Thomas Hummel
Hello,
When using LDAP backend with a DNS name (ldap_uri =
ldap://ldap.my.domain), I noticed that when the 'A' DNS record gets
modified, even if the OS resolver is getting the new ip address (command
'host ldap.my.domain' for instance), the sssd resolver
[be_resolve_server_process] was still caching the old ldap ip address.
It seems that a sssd restart is necessary (then, on the next request for
a non cached entry, a new connexion is made to the new ip address).
I didn't change 'ldap_connection_expire_timeout' which I'm not sure, by
the way, to quite understand as if I grep 'Found address for server' in
sssd log files, I don't see 15 min intervals.
So my questions are :
- is there a way to flush that cached ip (other than restarting) ?
- without restart, would sssd resolver indefinitely cache the old ip
address ?
- why don't I see periodic 15min intervals on 'Found address' in logs ?
Thanks
--
Thomas HUMMEL
7 years, 6 months
LDAP backend failover
by Thomas Hummel
Hello,
we're about to move 2 DNS LDAP backend (openldap-2.4.40) of sssd-1.12.4
from DNS round robin to a virtual ip on a load balancer. We don't use
SRV records.
So the plan is to go
from :
ldap_uri = ldaps://ldap.dom.ain
ldap.dom.ain having 2 IN A DNS records
to :
ldap_uri = ldaps://ldap.dom.ain
where ldap.dom.ain resolves in the load balancer hosted vip.
My understanding is that, in the target setup, if one of the backend is
shutdown or stop responding, sssd will still wait some timeout to
reconnect to the vip. So we still would have a time slice where
id <user>
would return no result (assuming <user> was not in the cache).
So the only gain for that matter would be that we would be garantied
that on the next backend connection, the backend would answer since the
loadbalancer would have pointed the connection to the working one.
Is there a way, other than tweaking the timout value, to avoid such
no-result hole ? (and without enmumarate = true either) ?
Thansk
--
Thomas HUMMEL
7 years, 6 months
sssd with multiple LDAP-sources to serve samba-logins
by Andreas Matthus
Hallo,
yes I can use multiple LDAP-sources to local login, su and ssh. That is
fine (The uid and gid are differ in all of them, so merge is possible).
But I search for a solution to use the logins for samba too.
The samba-mailinglist say: That is not our problem - ask sssd.
So I do that ;-) Can someone help me?
with regards
Andreas Matthus
--
Dipl.-Phys. Andreas Matthus
Netzwerkadministrator
Technische Universität Dresden
Fakultät Architektur
01062 Dresden
Tel.: +49 (351) 463-33909
Fax: +49 (351) 463-36120
E-Mail: andreas.matthus(a)tu-dresden.de
7 years, 6 months
Problem with automounter
by Ondrej Valousek
Hi List,
Problem - when I reboot my machine, sssd won't pick up autofs maps at the very beginning and can't even serve maps from the case - fine, that's a known problem that will be dealt with.
Now the second problem - I would expect that if I leave the machine running for some time, automount will eventually start working (as SSSD would come online & serve maps).
But this does not happen - waiting for a hour, but automounter still does not work.
I have to manually 'service autofs reload' to make it working.
Is that normal?
Note I have mostly indirect maps.
Thanks,
Ondrej
-----
The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.
7 years, 6 months
UID collision possibility in SSSD with a mix of WindowsAD and non-AD domains?
by sambitnayak+subscribe＠gmail.com
Hi,
Requesting answers to some queries.
On a client system, SSSD can be configured to query identity and authenticate against multiple domains - Windows Active Directory (AD) as well as non-AD ones like LDAP store or say, FreeIPA.
I understand that SSSD offers ID mapping for Windows AD objects (users, groups etc.) to offer a separate ID range/namespace for separate Windows AD domains.
(1) What about non-AD domains?
Can SSSD "map" separate ID ranges for different non-AD domains?
That is : assume that LDAP id provider backend is used by SSSD for the two non-AD domains "abc.com" and "xyz.com".
Can SSSD allot two different UIDs to user "alice(a)abc.com" and "alice(a)xyz.com" who have same UID in their respective domains?
(2) And, does SSSD ensure that ID ranges for such non-AD "abc.com" and "xyz.com" will not clash with another Windows AD domain "win.com" that SSSD is configured to work with? (I think the answer is yes here, but just double checking...)
Thanks & Regards,
Sambit
7 years, 6 months
sssd_be[30807]: ldapdb_canonuser_plug_init() failed in sasl_canonuser_add_plugin(): invalid parameter supplied after upgrading packages
by Steffen Knauf
Hello,
after upgrading sssd package from 1.13.0-40.el7_2.1 to 1.13.0-40.el7_2.9 and upgrading the cyrus-sasl Packages from 2.1.26-19.2.el7 to 2.1.26-20.el7_2
i got the following Message after restarting sssd:
sssd_be[30849]: ldapdb_canonuser_plug_init() failed in sasl_canonuser_add_plugin(): invalid parameter supplied
sssd_be[30849]: _sasl_plugin_load failed on sasl_canonuser_init for plugin: ldapdb
I don't change any configuration in sssd.conf or saslauthd.conf.
Setting the relevant debug_level = 9 in sssd.conf don't help, so perhaps can give me a hint?
greets
Steffen
7 years, 6 months
SSSD with AD and sudo (case sensitivity)
by John Beranek
Hi,
I've been following Jakub's useful blog post[1], attempting to get sudo
rules into our Active Directory, and usable by sudo via SSSD.
I've managed the schema extension, and built a rule, but whatever I've
tried I've not managed to get the rule to apply.
When I run "sudo -l" as the user should have received a sudo rule I get the
following:
[_johnbadm@sudotest ~]$ sudo -l
[sudo] password for _johnbadm:
Sorry, user _johnbadm may not run sudo on sudotest.
However, there *is* a rule in the SSSD db:
[root@sudotest ~]# ldbsearch -H /var/lib/sss/db/cache_AD.ldb
'(objectClass=sudoRule)'
asq: Unable to register control with rootdse!
# record 1
dn: name=lessrule,cn=sudorules,cn=custom,cn=AD,cn=sysdb
cn: lessrule
dataExpireTimestamp: 1475513295
entryUSN: 17309854
name: lessrule
objectClass: sudoRule
originalDN: CN=lessrule,OU=sudoers,DC=example,DC=com
sudoCommand: /usr/bin/less
sudoHost: ALL
sudoHost: *.example.com
sudoRunAsUser: ALL
sudoUser: _johnbadm
distinguishedName: name=lessrule,cn=sudorules,cn=custom,cn=AD,cn=sysdb
# returned 1 records
# 1 entries
# 0 referrals
I'm running CentOS 6.8, with SSSD 1.13.3-22.el6.
[root@sudotest ~]# grep sudo /etc/nsswitch.conf
sudoers: files sss
[root@sudotest ~]# grep sudo /etc/sssd/sssd.conf
services = nss, pam, sudo
I turned on debug for the SSSD sudo service, and get:
https://paste.fedoraproject.org/442892/72188147/
Just read the debug again, and had a hunch around case sensitivity...
When I change the sudo rule to have:
sudoUser: _johnbADM
instead of:
sudoUser: _johnbadm
it works. Surely the matching of rules should be case insensitive,
shouldn't it? The username form "_johnbADM" presumably works because the AD
user's sAMAccountName is the form with the mixed case, which you can see in
the SSSD DB:
# record 25
dn: name=_johnbADM,cn=users,cn=AD,cn=sysdb
createTimestamp: 1475573234
fullName: John Beranek ADM
gecos: John Beranek ADM
Thoughts?
John
--
John Beranek To generalise is to be an idiot.
http://redux.org.uk/ -- William Blake
7 years, 6 months
Using proxy for id_provider and ldap for auth_provider against AD
by Speagle, Andy
Hi Folks,
I'm attempting to create a configuration whereby Active Directory is used via LDAP only to authenticate ONLY local users via a proxy id_provider using local files... this was the configuration that I was attempting:
[sssd]
config_file_version = 2
domains = <domain>
services = nss, pam
[nss]
[pam]
[domain/<domain>]
debug_level = 9
id_provider = proxy
auth_provider = ldap
proxy_lib_name = files
cache_credentials = true
ldap_uri = <list,of,domain,controllers>
ldap_id_use_start_tls = true
ldap_tls_reqcert = allow
ldap_default_bind_dn = <bind account>
ldap_default_authtok = <bind sekrit>
ldap_schema = ad
ldap_search_base = <search base>
--
It seems to be finding my entry just fine in /etc/passwd... but, it seems to be unable to perform the LDAP search... as I get back these sanitized results... showing that it can't find my user object... for some reason...
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [<base>]
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=<myuser>)(objectclass=user))][<base>].
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectclass]
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName]
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 2
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_process_result] (0x2000): Trace: sh[0xf49a70], connected[1], ops[0xf49400], ldap[0xf45cc0]
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_process_result] (0x2000): Trace: sh[0xf49a70], connected[1], ops[0xf49400], ldap[0xf45cc0]
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_done] (0x0400): Search result: Operations error(1), 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Operations error(1), 000004DC: LdapErr: DSID-0C090752, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580
(Thu Sep 22 16:12:39 2016) [sssd[be[<domain>]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [5]: Input/output error
--
If I perform a manual ldapsearch ... using the parameters indicated in the "ldap_search_ext" call ... it works just fine. I've checked in the logs and I see that it marks the connection to the domain controller as "working" ... so, I'm not sure why sssd complains that a successful bind must be completed... that seems to have happened already...
I'm running sssd version 1.11.7 ...
Any ideas, folks?
Thanks,
Andy Speagle
7 years, 6 months
Which SSSD-version against which AD-level?
by Roger Mårtensson
Hi!
Trying to find a page that describes against what Active Directory
versions the LTM (1.13) and 1.14 is supporting. My Google-fu isn't
giving me anything.
Does it work with the just release GA of Windows and Active Directory?
Yours,
Roger
7 years, 6 months
