9:27 p.m.
Hi,
I have a server running ApacheDS with both SSL and TLS enabled with a valid keystore. It
allows me to connect via other ldap clients on both SSL and StartTLS and I’m able to use
Kerberos from the client machine.
However, when I configure sssd on a client machine to use ldap and use the ApacheDS as
it’s provider, it fails with the message
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [pam_print_data] (0x0100): domain:
AUTOMATON.UK
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [pam_print_data] (0x0100): user:
aaron.jenkins
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [pam_print_data] (0x0100): service:
login
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [pam_print_data] (0x0100): tty:
/dev/pts/15
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [pam_print_data] (0x0100): ruser:
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [pam_print_data] (0x0100): rhost:
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [pam_print_data] (0x0100): authtok
type: 1
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [pam_print_data] (0x0100): newauthtok
type: 0
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [pam_print_data] (0x0100): priv: 1
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [pam_print_data] (0x0100): cli_pid:
9586
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [fo_resolve_service_send] (0x0100):
Trying to resolve service 'LDAP'
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [be_resolve_server_process] (0x0200):
Found address for server ds.automaton.uk: [10.211.55.27] TTL 7200
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [sdap_sys_connect_done] (0x0100):
Executing START TLS
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [sdap_connect_done] (0x0080): START
TLS result: Success(0), (null)
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [sdap_connect_done] (0x0080):
ldap_install_tls failed: [Connect error] [(unknown error code)]
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [fo_set_port_status] (0x0100): Marking
port 10389 of server 'ds.automaton.uk' as 'not working'
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [fo_resolve_service_send] (0x0100):
Trying to resolve service 'LDAP'
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [fo_resolve_service_send] (0x0020): No
available servers for service 'LDAP'
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [be_run_offline_cb] (0x0080): Going
offline. Running callbacks.
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [be_pam_handler_callback] (0x0100):
Backend returned: (1, 9, <NULL>) [Provider is Offline (Authentication service cannot
retrieve authentication info)]
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [be_pam_handler_callback] (0x0100):
Sending result [9][AUTOMATON.UK]
(Thu Nov 13 19:19:50 2014) [sssd[be[AUTOMATON.UK]]] [be_pam_handler_callback] (0x0100):
Sent result [9][AUTOMATON.UK]
My sssd configuration is as follows:
[sssd]
config_file_version = 2
services = nss, pam
domains = AUTOMATON.UK
debug_level = 5
[domain/AUTOMATON.UK]
debug_level = 5
cache_credentials = true
id_provider = ldap
auth_provider = ldap
ldap_uri = ldap://ds.automaton.uk:10389
ldap_search_base = dc=automaton,dc=uk
chpass_provider = ldap
entry_cache_timeout = 600
ldap_network_timeout = 2
The search base and the uri is correct as it works with other things. Do you guys have any
idea what could be going wrong?