Provider sporadically considered Offline and never restores

[dweller dweller]

Hello,

I am encountering a persistent issue with sssd intermittently identifying the ipa backend as offline and failing to return online. Initially, I temporarily resolved this by restarting the service, but the problem persists without a permanent solution. I am reluctant to restart the service each time a user encounters this issue.

When sssd indicates that backend is Offline in the logs, I can successfully execute 'id' and 'kinit' commands for the affected user. The 'id' command retrieves the actual groups stored in FreeIPA, confirming that FreeIPA is operational and healthy. However, sssd seems to disagree and indicates otherwise.

I've provided a link to a comprehensive log file containing all entries from /var/log/sssd/ during the SSH login attempt for the 'test-user-ssh':

https://disk.yandex.ru/d/NgiMAHUxgh24Dw

My system configurations are as follows:

sssd version: sssd-2.6.1-alt2.x86_64
freeipa-client version: freeipa-client-4.8.9-alt4.c9f2.3.x86_64
Here is a snippet of my sssd.conf file, in its default state post ipa-client-install:

plaintext
Copy code
[domain/custom.in-realm.domain]
id_provider = ipa
ipa_server = ipa-01.my-realm.internal
ipa_domain = custom.in-realm.domain
ipa_hostname = studio-01.custom.in-realm.domain
krb5_realm = MY-REALM.INTERNAL
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
krb5_store_password_if_offline = True

[sssd]
config_file_version = 2
services = nss, pam, ssh, sudo
user = _sssd
domains = custom.in-realm.domain

[nss]
[ssh]
[sudo]
Any insights or assistance in resolving this recurring sssd issue would be greatly appreciated.

[Diego Zuccato]

Seems the mailing list got abandoned. Try raising an issue on
https://github.com/SSSD/sssd ... it seems a bit more alive.

Il giorno lun 20 nov 2023 alle ore 13:24 dweller dweller 
ha scritto:
> Hello,
>
> I am encountering a persistent issue with sssd intermittently identifying
> the ipa backend as offline and failing to return online. Initially, I
> temporarily resolved this by restarting the service, but the problem
> persists without a permanent solution. I am reluctant to restart the
> service each time a user encounters this issue.
>
> When sssd indicates that backend is Offline in the logs, I can
> successfully execute 'id' and 'kinit' commands for the affected user. The
> 'id' command retrieves the actual groups stored in FreeIPA, confirming that
> FreeIPA is operational and healthy. However, sssd seems to disagree and
> indicates otherwise.
>
> I've provided a link to a comprehensive log file containing all entries
> from /var/log/sssd/ during the SSH login attempt for the 'test-user-ssh':
>
> https://disk.yandex.ru/d/NgiMAHUxgh24Dw
>
> My system configurations are as follows:
>
> sssd version: sssd-2.6.1-alt2.x86_64
> freeipa-client version: freeipa-client-4.8.9-alt4.c9f2.3.x86_64
> Here is a snippet of my sssd.conf file, in its default state post
> ipa-client-install:
>
> plaintext
> Copy code
> [domain/custom.in-realm.domain]
> id_provider = ipa
> ipa_server = ipa-01.my-realm.internal
> ipa_domain = custom.in-realm.domain
> ipa_hostname = studio-01.custom.in-realm.domain
> krb5_realm = MY-REALM.INTERNAL
> auth_provider = ipa
> chpass_provider = ipa
> access_provider = ipa
> cache_credentials = True
> ldap_tls_cacert = /etc/ipa/ca.crt
> krb5_store_password_if_offline = True
>
> [sssd]
> config_file_version = 2
> services = nss, pam, ssh, sudo
> user = _sssd
> domains = custom.in-realm.domain
>
> [nss]
> [ssh]
> [sudo]
> Any insights or assistance in resolving this recurring sssd issue would be
> greatly appreciated.
> --
> _______________________________________________
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail].o...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue