Could not convert objectSID [...] to a UNIX ID

[Hans Schou]

Hi

I have two users in the AD. Only one of them can login with ssh or su on the Linux
server.

The user admjoin is the one made the "realm join" and he can login:
/var/log/sssd/sssd_corp.acme.com.log:
Mapping user [AdmJoin] objectSID [S-1-5-21-2031436270-1094658265-1854952973-140256] to
unix ID
Adding original memberOf attributes to [AdmJoin].

And avgjoe can not login:
Mapping user [AvgJoe] objectSID [S-1-5-21-2031436270-1094658265-1854952973-340002] to unix
ID
Could not convert objectSID [S-1-5-21-2031436270-1094658265-1854952973-340002] to a UNIX
ID

Why can user avgjoe not log in?
(and why are the ObjectSID the same (if relevant)?)

Note that when doing a "su - avgjoe" the AD converts it to AvgJoe in log-file,
as defined on the AD-server.

I guess there is around 20000 users defined in the AD. User AdmJoin was created when the
system was setup, and user AvgJoe is added recently (he might have a very high numeric
id).

[sssd]
domains = corp.acme.com
config_file_version = 2
services = nss, pam, ssh, sudo
debug_level = 7

[domain/corp.acme.com]
ad_domain = corp.acme.com
krb5_realm = CORP.ACME.COM
realmd_tags = manages-system joined-with-samba
#cache_credentials = True
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%d/%u
access_provider = ad
debug_level = 7
ldap_idmap_range_min = 200000
ldap_idmap_range_max = 2000200000
ldap_idmap_range_size = 200000

Any help is much appreciated.

best regards
Hans

[Lukas Slebodnik]

On (12/01/16 14:00), hsc(a)miracle.dk wrote:
> Hi
>
> I have two users in the AD. Only one of them can login with ssh or su on the Linux
> server.
>
> The user admjoin is the one made the "realm join" and he can login:
> /var/log/sssd/sssd_corp.acme.com.log:
> Mapping user [AdmJoin] objectSID [S-1-5-21-2031436270-1094658265-1854952973-140256] to
> unix ID
> Adding original memberOf attributes to [AdmJoin].
>
> And avgjoe can not login:
> Mapping user [AvgJoe] objectSID [S-1-5-21-2031436270-1094658265-1854952973-340002] to unix
> ID
> Could not convert objectSID [S-1-5-21-2031436270-1094658265-1854952973-340002] to a UNIX
> ID
>  
because RID (relative ID) of user SID is too big.

The default value of range size (ldap_idmap_range_size)
is 200000. So this user does not fit there.

You can increase ldap_idmap_range_size to bigger value,
but you will need to remove sssd cache after changing
idmap settings. This will results in different UID/GID of users.

@see also
man sssd-ldap -> ldap_idmap_range_size
man sssd-ldap -> ID MAPPING -> 3rd paragraph

LS


>Why can user avgjoe not log in?
>(and why are the ObjectSID the same (if relevant)?)
>
>Note that when doing a "su - avgjoe" the AD converts it to AvgJoe in
log-file, as defined on the AD-server.
>
>I guess there is around 20000 users defined in the AD. User AdmJoin was created when
the system was setup, and user AvgJoe is added recently (he might have a very high numeric
id).
>
>[sssd]
>domains = corp.acme.com
>config_file_version = 2
>services = nss, pam, ssh, sudo
>debug_level = 7
>
>[domain/corp.acme.com]
>ad_domain = corp.acme.com
>krb5_realm = CORP.ACME.COM
>realmd_tags = manages-system joined-with-samba
>#cache_credentials = True
>cache_credentials = False
>id_provider = ad
>krb5_store_password_if_offline = True
>default_shell = /bin/bash
>ldap_id_mapping = True
>use_fully_qualified_names = False
>fallback_homedir = /home/%d/%u
>access_provider = ad
>debug_level = 7
>ldap_idmap_range_min = 200000
>ldap_idmap_range_max = 2000200000
>ldap_idmap_range_size = 200000
>
>Any help is much appreciated.
>
>best regards
>Hans
>_______________________________________________
>sssd-users mailing list
>sssd-users(a)lists.fedorahosted.org
>https://lists.fedorahosted.org/admin/lists/[e-mail]

[Hans Schou]

>  On (12/01/16 14:00), hsc(a)miracle.dk wrote:
>  because RID (relative ID) of user SID is too big. 
Which part is the RID?


>  The default value of range size (ldap_idmap_range_size)
>  is 200000. So this user does not fit there.
>  
>  You can increase ldap_idmap_range_size to bigger value, 
OK, I tried 

>  but you will need to remove sssd cache after changing
>  idmap settings. This will results in different UID/GID of users. 
I did a:
  cd /var/lib/sssd/db && rm *
and stated again. now it says:

(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [be_get_account_info] (0x0100): Got
request for [4097][1][idnumber=952940256]
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [be_req_set_domain] (0x0400):
Changing request domain from [corp.acme.com] to [corp.acme.com]
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [ad_account_can_shortcut] (0x0080):
Mapping ID [952940256] to SID failed: [IDMAP domain not found]
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [ad_account_info_handler] (0x0400):
Cannot determine the right domain: Input/output error
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [users_get_send] (0x0080):
[952940256] did not match any configured ID mapping domain
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [sysdb_search_user_by_uid] (0x0400):
No such entry
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [sysdb_delete_user] (0x0400): Error:
2 (No such file or directory)
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [acctinfo_callback] (0x0100): Request
processed. Returned 0,0,Success
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [be_get_account_info] (0x0100): Got
request for [4097][1][idnumber=952940256]
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [be_req_set_domain] (0x0400):
Changing request domain from [corp.acme.com] to [ad-root.acme.com]
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [ad_account_can_shortcut] (0x0080):
Mapping ID [952940256] to SID failed: [IDMAP domain not found]
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [ad_account_info_handler] (0x0400):
Cannot determine the right domain: Input/output error
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [users_get_send] (0x0080):
[952940256] did not match any configured ID mapping domain
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [sysdb_search_user_by_uid] (0x0400):
No such entry
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [sysdb_delete_user] (0x0400): Error:
2 (No such file or directory)
(Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [acctinfo_callback] (0x0100): Request
processed. Returned 0,0,Success

>  ＠see also
>  man sssd-ldap -> ldap_idmap_range_size
>  man sssd-ldap -> ID MAPPING -> 3rd paragraph 
Thanks. I seems like it should be possible to calcutae the right size in some way.

./hans

[Hans Schou]

Thanks, it is workning now.

The first value I tried for ldap_idmap_range_size was too high.

I then took the RID which I suppose is the last number in the SID:
340002
and gave it a little higher value
400000

Remove /var/lib/sss/db and restart sssd.



On 13 January 2016 at 08:36, <hsc(a)miracle.dk&gt; wrote:

>  > On (12/01/16 14:00), hsc(a)miracle.dk wrote:
>  > because RID (relative ID) of user SID is too big.
>
>  Which part is the RID?
>
>
>  > The default value of range size (ldap_idmap_range_size)
>  > is 200000. So this user does not fit there.
>  >
>  > You can increase ldap_idmap_range_size to bigger value,
>
>  OK, I tried
>
>  > but you will need to remove sssd cache after changing
>  > idmap settings. This will results in different UID/GID of users.
>
>  I did a:
>    cd /var/lib/sssd/db && rm *
>  and stated again. now it says:
>
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]]
>  [be_get_account_info] (0x0100): Got request for
>  [4097][1][idnumber=952940256]
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [be_req_set_domain]
>  (0x0400): Changing request domain from [corp.acme.com] to [corp.acme.com]
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]]
>  [ad_account_can_shortcut] (0x0080): Mapping ID [952940256] to SID failed:
>  [IDMAP domain not found]
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]]
>  [ad_account_info_handler] (0x0400): Cannot determine the right domain:
>  Input/output error
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [users_get_send]
>  (0x0080): [952940256] did not match any configured ID mapping domain
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]]
>  [sysdb_search_user_by_uid] (0x0400): No such entry
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [sysdb_delete_user]
>  (0x0400): Error: 2 (No such file or directory)
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [acctinfo_callback]
>  (0x0100): Request processed. Returned 0,0,Success
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]]
>  [be_get_account_info] (0x0100): Got request for
>  [4097][1][idnumber=952940256]
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [be_req_set_domain]
>  (0x0400): Changing request domain from [corp.acme.com] to [
>  ad-root.acme.com]
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]]
>  [ad_account_can_shortcut] (0x0080): Mapping ID [952940256] to SID failed:
>  [IDMAP domain not found]
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]]
>  [ad_account_info_handler] (0x0400): Cannot determine the right domain:
>  Input/output error
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [users_get_send]
>  (0x0080): [952940256] did not match any configured ID mapping domain
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]]
>  [sysdb_search_user_by_uid] (0x0400): No such entry
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [sysdb_delete_user]
>  (0x0400): Error: 2 (No such file or directory)
>  (Wed Jan 13 07:31:06 2016) [sssd[be[corp.acme.com]]] [acctinfo_callback]
>  (0x0100): Request processed. Returned 0,0,Success
>
>  > ＠see also
>  > man sssd-ldap -> ldap_idmap_range_size
>  > man sssd-ldap -> ID MAPPING -> 3rd paragraph
>
>  Thanks. I seems like it should be possible to calcutae the right size in
>  some way.
>
>  ./hans
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>  


-- 

Venlig hilsen - best regards
*Hans Schou*
Konsulent
Mobil: 53747192
E-mail: hsc(a)miracle.dk
<https://twitter.com/miracledenmark>
<https://www.facebook.com/miracledenmark>
<https://www.linkedin.com/company/miracle-as>

Miracle ⅍, Borupvang 2C, 2750 Ballerup
info(a)miracle.dk - www.miracle.dk <http://miracle.dk/>