SSSD-AD GPO integration | general question

[Rolla Matthieu]

Hello, I was using previously sssd to authenticate my user using id_provider = LDAP and it
works great.

Now that my samba 4 DC is configured and that the GPO can finally be used, I reconfigured
sssd with realmd to be able to use sssd-ad to centralize the authentification for some
services via the GPO. 
SSSD was configured automatically by realm as expected and the server is registrer in the
appropriate OU as define in /etc/realmd.conf in my DC.  I can also successfully retrieve
my users/group info with getent and id. 

Following the example presented here
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration, I notice that
when I try to authenticate a user with SSH I can see errors relative to the retrieve of
the GPO http://pastebin.com/6wzXUrCr 


Here is my sssd,confconfiguration: 

[sssd]
config_file_version = 2
services = nss, pam
domains = hq.mydc.com

[nss]
# Ensure that certain users are not authenticated from network accounts
filter_users =
root,lightdm,nslcd,dnsmasq,dbus,avahi,avahi-autoipd,backup,beagleindex,bin,daemon,games,gdm,gnats,haldaemon,hplip,irc,ivman,klog,libuuid,list,lp,mail,man,messagebus,mysql,news,ntp,openldap,polkituser,proxy,pulse,puppet,saned,sshd,sync,sys,syslog,uucp,vde2-net,www-data
filter_groups = root

[pam]

[domain/hq.mydc.com]                                            
<----------------------- this part was generated automatically
debug_level = 9
ad_domain = hq.mydc.com
krb5_realm = HQ.mydc.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = ad



Does sssd need to mount/access to the sysvol folder somehow ?  Did I missed something in
the configuration of sssd ? 

Looking forward for some help ,thanks by advance.

[Sumit Bose]

On Wed, Apr 20, 2016 at 04:14:49AM -0000, rolla.matthieu(a)gmail.com wrote:
>  Hello, I was using previously sssd to authenticate my user using
> id_provider = LDAP and it works great.
>  
>  Now that my samba 4 DC is configured and that the GPO can finally be used, I reconfigured
> sssd with realmd to be able to use sssd-ad to centralize the authentification for some
> services via the GPO. 
>  SSSD was configured automatically by realm as expected and the server is registrer in the
> appropriate OU as define in /etc/realmd.conf in my DC.  I can also successfully retrieve
> my users/group info with getent and id. 
>  
>  Following the example presented here
> https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration, I notice that
> when I try to authenticate a user with SSH I can see errors relative to the retrieve of
> the GPO http://pastebin.com/6wzXUrCr  
Can you check/send the gpo_child log file as well?

bye,
Sumit

> 
> 
> Here is my sssd,confconfiguration: 
> 
> [sssd]
> config_file_version = 2
> services = nss, pam
> domains = hq.mydc.com
> 
> [nss]
> # Ensure that certain users are not authenticated from network accounts
> filter_users =
root,lightdm,nslcd,dnsmasq,dbus,avahi,avahi-autoipd,backup,beagleindex,bin,daemon,games,gdm,gnats,haldaemon,hplip,irc,ivman,klog,libuuid,list,lp,mail,man,messagebus,mysql,news,ntp,openldap,polkituser,proxy,pulse,puppet,saned,sshd,sync,sys,syslog,uucp,vde2-net,www-data
> filter_groups = root
> 
> [pam]
> 
> [domain/hq.mydc.com]                                            
<----------------------- this part was generated automatically
> debug_level = 9
> ad_domain = hq.mydc.com
> krb5_realm = HQ.mydc.COM
> realmd_tags = manages-system joined-with-samba
> cache_credentials = True
> id_provider = ad
> krb5_store_password_if_offline = True
> default_shell = /bin/bash
> ldap_id_mapping = True
> use_fully_qualified_names = True
> fallback_homedir = /home/%d/%u
> access_provider = ad
> 
> 
> 
> Does sssd need to mount/access to the sysvol folder somehow ?  Did I missed something
in the configuration of sssd ? 
> 
> Looking forward for some help ,thanks by advance.
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/admin/lists/[e-mail]

[Rolla Matthieu]

Hello,

Thank you for your answer. The file gpo_child is empty :

root@gtw-template:/var/log/sssd# ls -ltr
total 14656
-rw------- 1 root root        0 Apr 19 21:44 gpo_child.log
-rw------- 1 root root     3050 Apr 19 23:16 sssd_pam.log
-rw------- 1 root root     3050 Apr 19 23:16 sssd_nss.log
-rw------- 1 root root    21970 Apr 19 23:22 sssd.log
-rw------- 1 root root    49771 Apr 19 23:22 ldap_child.log
-rw------- 1 root root   112878 Apr 19 23:22 krb5_child.log
-rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log

Do you want me to attach an other one ?

Thank you by advance.

[Sumit Bose]

On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
>  Hello,
>  
>  Thank you for your answer. The file gpo_child is empty :
>  
>  root@gtw-template:/var/log/sssd# ls -ltr
>  total 14656
>  -rw------- 1 root root        0 Apr 19 21:44 gpo_child.log
>  -rw------- 1 root root     3050 Apr 19 23:16 sssd_pam.log
>  -rw------- 1 root root     3050 Apr 19 23:16 sssd_nss.log
>  -rw------- 1 root root    21970 Apr 19 23:22 sssd.log
>  -rw------- 1 root root    49771 Apr 19 23:22 ldap_child.log
>  -rw------- 1 root root   112878 Apr 19 23:22 krb5_child.log
>  -rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
>  
>  Do you want me to attach an other one ? 
No, I just realized that the error happens even before the child is
called. It looks like some unexpected data is received.

I wonder if you can try to following using gdb after installing the sssd
debuginfo file?

    gdb -p $(pidof sssd_be)
    (gdb) break ad_gpo_parse_machine_ext_names
    (gdb) continue

try to authenticate while keeping gdb running, whenever gdb show the
prompt again please type

    (gdb) bt full
    (gdb) continue

until the authentication finally fails. Please send me the gdb output.

If this won't work for you I can try to prepare an instrumented build
for you which writes the needed data into the logs. For this I need to
know the exact version of the SSSD package you are using.

bye,
Sumit
    
>  
>  Thank you by advance. 
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/admin/lists/[e-mail]

[Rolla Matthieu]

Hello,

I think the problem come from my DC and the GPO part. I can install a
windows DC to perform test, would you recommend 2008 or 2012 ?

Thanks by advance.

On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com&gt; wrote:

>  On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
>  > Hello,
>  >
>  > Thank you for your answer. The file gpo_child is empty :
>  >
>  > root@gtw-template:/var/log/sssd# ls -ltr
>  > total 14656
>  > -rw------- 1 root root        0 Apr 19 21:44 gpo_child.log
>  > -rw------- 1 root root     3050 Apr 19 23:16 sssd_pam.log
>  > -rw------- 1 root root     3050 Apr 19 23:16 sssd_nss.log
>  > -rw------- 1 root root    21970 Apr 19 23:22 sssd.log
>  > -rw------- 1 root root    49771 Apr 19 23:22 ldap_child.log
>  > -rw------- 1 root root   112878 Apr 19 23:22 krb5_child.log
>  > -rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
>  >
>  > Do you want me to attach an other one ?
>
>  No, I just realized that the error happens even before the child is
>  called. It looks like some unexpected data is received.
>
>  I wonder if you can try to following using gdb after installing the sssd
>  debuginfo file?
>
>      gdb -p $(pidof sssd_be)
>      (gdb) break ad_gpo_parse_machine_ext_names
>      (gdb) continue
>
>  try to authenticate while keeping gdb running, whenever gdb show the
>  prompt again please type
>
>      (gdb) bt full
>      (gdb) continue
>
>  until the authentication finally fails. Please send me the gdb output.
>
>  If this won't work for you I can try to prepare an instrumented build
>  for you which writes the needed data into the logs. For this I need to
>  know the exact version of the SSSD package you are using.
>
>  bye,
>  Sumit
>
>  >
>  > Thank you by advance.
>
>  > _______________________________________________
>  > sssd-users mailing list
>  > sssd-users(a)lists.fedorahosted.org
>  >
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>

[Sumit Bose]

On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
>  Hello,
>  
>  I think the problem come from my DC and the GPO part. I can install a 
That's what I'm thinking too. But I expect that the response from your DC
is valid but unexpected by SSSD. So it would be good to see what data
the DC returned which SSSD failed to parse. The gdb steps below should
show this data. If you prefer to just run a test build with additional
debug output please let me know which version you currently use.

>  windows DC to perform test, would you recommend 2008 or 2012 ?
I think it is not necessary to perform additional tests here.

bye,
Sumit

>  
>  Thanks by advance.
>  
>  On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com&gt; wrote:
>  
>  > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
>  > > Hello,
>  > >
>  > > Thank you for your answer. The file gpo_child is empty :
>  > >
>  > > root@gtw-template:/var/log/sssd# ls -ltr
>  > > total 14656
>  > > -rw------- 1 root root        0 Apr 19 21:44 gpo_child.log
>  > > -rw------- 1 root root     3050 Apr 19 23:16 sssd_pam.log
>  > > -rw------- 1 root root     3050 Apr 19 23:16 sssd_nss.log
>  > > -rw------- 1 root root    21970 Apr 19 23:22 sssd.log
>  > > -rw------- 1 root root    49771 Apr 19 23:22 ldap_child.log
>  > > -rw------- 1 root root   112878 Apr 19 23:22 krb5_child.log
>  > > -rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
>  > >
>  > > Do you want me to attach an other one ?
>  >
>  > No, I just realized that the error happens even before the child is
>  > called. It looks like some unexpected data is received.
>  >
>  > I wonder if you can try to following using gdb after installing the sssd
>  > debuginfo file?
>  >
>  >     gdb -p $(pidof sssd_be)
>  >     (gdb) break ad_gpo_parse_machine_ext_names
>  >     (gdb) continue
>  >
>  > try to authenticate while keeping gdb running, whenever gdb show the
>  > prompt again please type
>  >
>  >     (gdb) bt full
>  >     (gdb) continue
>  >
>  > until the authentication finally fails. Please send me the gdb output.
>  >
>  > If this won't work for you I can try to prepare an instrumented build
>  > for you which writes the needed data into the logs. For this I need to
>  > know the exact version of the SSSD package you are using.
>  >
>  > bye,
>  > Sumit
>  >
>  > >
>  > > Thank you by advance.
>  >
>  > > _______________________________________________
>  > > sssd-users mailing list
>  > > sssd-users(a)lists.fedorahosted.org
>  > >
>  > https://lists.fedorahosted.org/admin/lists/[e-mail]
>  > _______________________________________________
>  > sssd-users mailing list
>  > sssd-users(a)lists.fedorahosted.org
>  >
>  > https://lists.fedorahosted.org/admin/lists/[e-mail]
>  > 
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/admin/lists/[e-mail]

[Rolla Matthieu]

Hello,

I use debian jessy with the testing package for sssd as I did not find a
version in the backport above 1.12, as I need the GPO functionnality.

The debuginfo seems to be available only with RPM.

However, I configured a 2012 DC and got other issue, some that I could fix
but I got similar situation with the GPO.

I decided to installed a Centos 7 with sssd and the GPO are working fine.
I will give a try and build a VM with a new DC with samba 4. Maybe it will
be better wilt the centos 7.

Just one question, I can authenticate with user@domain, is there a way to
omit the suffix ( @domain ) ?



thanks by advance.


On Wed, Apr 20, 2016 at 5:43 PM, Sumit Bose <sbose(a)redhat.com&gt; wrote:

>  On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
>  > Hello,
>  >
>  > I think the problem come from my DC and the GPO part. I can install a
>
>  That's what I'm thinking too. But I expect that the response from your DC
>  is valid but unexpected by SSSD. So it would be good to see what data
>  the DC returned which SSSD failed to parse. The gdb steps below should
>  show this data. If you prefer to just run a test build with additional
>  debug output please let me know which version you currently use.
>
>  > windows DC to perform test, would you recommend 2008 or 2012 ?
>
>  I think it is not necessary to perform additional tests here.
>
>  bye,
>  Sumit
>
>  >
>  > Thanks by advance.
>  >
>  > On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com&gt; wrote:
>  >
>  > > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
>  > > > Hello,
>  > > >
>  > > > Thank you for your answer. The file gpo_child is empty :
>  > > >
>  > > > root@gtw-template:/var/log/sssd# ls -ltr
>  > > > total 14656
>  > > > -rw------- 1 root root        0 Apr 19 21:44 gpo_child.log
>  > > > -rw------- 1 root root     3050 Apr 19 23:16 sssd_pam.log
>  > > > -rw------- 1 root root     3050 Apr 19 23:16 sssd_nss.log
>  > > > -rw------- 1 root root    21970 Apr 19 23:22 sssd.log
>  > > > -rw------- 1 root root    49771 Apr 19 23:22 ldap_child.log
>  > > > -rw------- 1 root root   112878 Apr 19 23:22 krb5_child.log
>  > > > -rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
>  > > >
>  > > > Do you want me to attach an other one ?
>  > >
>  > > No, I just realized that the error happens even before the child is
>  > > called. It looks like some unexpected data is received.
>  > >
>  > > I wonder if you can try to following using gdb after installing the
>  sssd
>  > > debuginfo file?
>  > >
>  > >     gdb -p $(pidof sssd_be)
>  > >     (gdb) break ad_gpo_parse_machine_ext_names
>  > >     (gdb) continue
>  > >
>  > > try to authenticate while keeping gdb running, whenever gdb show the
>  > > prompt again please type
>  > >
>  > >     (gdb) bt full
>  > >     (gdb) continue
>  > >
>  > > until the authentication finally fails. Please send me the gdb output.
>  > >
>  > > If this won't work for you I can try to prepare an instrumented build
>  > > for you which writes the needed data into the logs. For this I need to
>  > > know the exact version of the SSSD package you are using.
>  > >
>  > > bye,
>  > > Sumit
>  > >
>  > > >
>  > > > Thank you by advance.
>  > >
>  > > > _______________________________________________
>  > > > sssd-users mailing list
>  > > > sssd-users(a)lists.fedorahosted.org
>  > > >
>  > >
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>  > > _______________________________________________
>  > > sssd-users mailing list
>  > > sssd-users(a)lists.fedorahosted.org
>  > >
>  > >
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>  > >
>
>  > _______________________________________________
>  > sssd-users mailing list
>  > sssd-users(a)lists.fedorahosted.org
>  >
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>

[Rolla Matthieu]

Solved.

On Thu, Apr 21, 2016 at 7:16 AM, Rolla Matthieu <rolla.matthieu(a)gmail.com&gt;
wrote:

>  Hello,
>
>  I use debian jessy with the testing package for sssd as I did not find a
>  version in the backport above 1.12, as I need the GPO functionnality.
>
>  The debuginfo seems to be available only with RPM.
>
>  However, I configured a 2012 DC and got other issue, some that I could fix
>  but I got similar situation with the GPO.
>
>  I decided to installed a Centos 7 with sssd and the GPO are working fine.
>  I will give a try and build a VM with a new DC with samba 4. Maybe it will
>  be better wilt the centos 7.
>
>  Just one question, I can authenticate with user@domain, is there a way to
>  omit the suffix ( @domain ) ?
>
>
>
>  thanks by advance.
>
>
>  On Wed, Apr 20, 2016 at 5:43 PM, Sumit Bose <sbose(a)redhat.com&gt; wrote:
>
> > On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
> > > Hello,
> > >
> > > I think the problem come from my DC and the GPO part. I can install a
> >
> > That's what I'm thinking too. But I expect that the response from your DC
> > is valid but unexpected by SSSD. So it would be good to see what data
> > the DC returned which SSSD failed to parse. The gdb steps below should
> > show this data. If you prefer to just run a test build with additional
> > debug output please let me know which version you currently use.
> >
> > > windows DC to perform test, would you recommend 2008 or 2012 ?
> >
> > I think it is not necessary to perform additional tests here.
> >
> > bye,
> > Sumit
> >
> > >
> > > Thanks by advance.
> > >
> > > On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com&gt; wrote:
> > >
> > > > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
> > > > > Hello,
> > > > >
> > > > > Thank you for your answer. The file gpo_child is empty :
> > > > >
> > > > > root@gtw-template:/var/log/sssd# ls -ltr
> > > > > total 14656
> > > > > -rw------- 1 root root        0 Apr 19 21:44 gpo_child.log
> > > > > -rw------- 1 root root     3050 Apr 19 23:16 sssd_pam.log
> > > > > -rw------- 1 root root     3050 Apr 19 23:16 sssd_nss.log
> > > > > -rw------- 1 root root    21970 Apr 19 23:22 sssd.log
> > > > > -rw------- 1 root root    49771 Apr 19 23:22 ldap_child.log
> > > > > -rw------- 1 root root   112878 Apr 19 23:22 krb5_child.log
> > > > > -rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
> > > > >
> > > > > Do you want me to attach an other one ?
> > > >
> > > > No, I just realized that the error happens even before the child is
> > > > called. It looks like some unexpected data is received.
> > > >
> > > > I wonder if you can try to following using gdb after installing the
> > sssd
> > > > debuginfo file?
> > > >
> > > >     gdb -p $(pidof sssd_be)
> > > >     (gdb) break ad_gpo_parse_machine_ext_names
> > > >     (gdb) continue
> > > >
> > > > try to authenticate while keeping gdb running, whenever gdb show the
> > > > prompt again please type
> > > >
> > > >     (gdb) bt full
> > > >     (gdb) continue
> > > >
> > > > until the authentication finally fails. Please send me the gdb output.
> > > >
> > > > If this won't work for you I can try to prepare an instrumented build
> > > > for you which writes the needed data into the logs. For this I need to
> > > > know the exact version of the SSSD package you are using.
> > > >
> > > > bye,
> > > > Sumit
> > > >
> > > > >
> > > > > Thank you by advance.
> > > >
> > > > > _______________________________________________
> > > > > sssd-users mailing list
> > > > > sssd-users(a)lists.fedorahosted.org
> > > > >
> > > >
> > https://lists.fedorahosted.org/admin/lists/[e-mail]
> > > > _______________________________________________
> > > > sssd-users mailing list
> > > > sssd-users(a)lists.fedorahosted.org
> > > >
> > > >
> > https://lists.fedorahosted.org/admin/lists/[e-mail]
> > > >
> >
> > > _______________________________________________
> > > sssd-users mailing list
> > > sssd-users(a)lists.fedorahosted.org
> > >
> > https://lists.fedorahosted.org/admin/lists/[e-mail]
> > _______________________________________________
> > sssd-users mailing list
> > sssd-users(a)lists.fedorahosted.org
> >
> > https://lists.fedorahosted.org/admin/lists/[e-mail]
> >
>
>

[Sumit Bose]

On Thu, Apr 21, 2016 at 08:28:21AM +0200, Rolla Matthieu wrote:
>  Solved. 
Everything?

bye,
Sumit

>  
>  On Thu, Apr 21, 2016 at 7:16 AM, Rolla Matthieu <rolla.matthieu(a)gmail.com&gt;
>  wrote:
>  
>  > Hello,
>  >
>  > I use debian jessy with the testing package for sssd as I did not find a
>  > version in the backport above 1.12, as I need the GPO functionnality.
>  >
>  > The debuginfo seems to be available only with RPM.
>  >
>  > However, I configured a 2012 DC and got other issue, some that I could fix
>  > but I got similar situation with the GPO.
>  >
>  > I decided to installed a Centos 7 with sssd and the GPO are working fine.
>  > I will give a try and build a VM with a new DC with samba 4. Maybe it will
>  > be better wilt the centos 7.
>  >
>  > Just one question, I can authenticate with user@domain, is there a way to
>  > omit the suffix ( @domain ) ?
>  >
>  >
>  >
>  > thanks by advance.
>  >
>  >
>  > On Wed, Apr 20, 2016 at 5:43 PM, Sumit Bose <sbose(a)redhat.com&gt; wrote:
>  >
>  >> On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
>  >> > Hello,
>  >> >
>  >> > I think the problem come from my DC and the GPO part. I can install a
>  >>
>  >> That's what I'm thinking too. But I expect that the response from your
> DC
>  >> is valid but unexpected by SSSD. So it would be good to see what data
>  >> the DC returned which SSSD failed to parse. The gdb steps below should
>  >> show this data. If you prefer to just run a test build with additional
>  >> debug output please let me know which version you currently use.
>  >>
>  >> > windows DC to perform test, would you recommend 2008 or 2012 ?
>  >>
>  >> I think it is not necessary to perform additional tests here.
>  >>
>  >> bye,
>  >> Sumit
>  >>
>  >> >
>  >> > Thanks by advance.
>  >> >
>  >> > On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com&gt;
> wrote:
>  >> >
>  >> > > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
>  >> > > > Hello,
>  >> > > >
>  >> > > > Thank you for your answer. The file gpo_child is empty :
>  >> > > >
>  >> > > > root@gtw-template:/var/log/sssd# ls -ltr
>  >> > > > total 14656
>  >> > > > -rw------- 1 root root        0 Apr 19 21:44 gpo_child.log
>  >> > > > -rw------- 1 root root     3050 Apr 19 23:16 sssd_pam.log
>  >> > > > -rw------- 1 root root     3050 Apr 19 23:16 sssd_nss.log
>  >> > > > -rw------- 1 root root    21970 Apr 19 23:22 sssd.log
>  >> > > > -rw------- 1 root root    49771 Apr 19 23:22 ldap_child.log
>  >> > > > -rw------- 1 root root   112878 Apr 19 23:22 krb5_child.log
>  >> > > > -rw------- 1 root root 14800060 Apr 20 00:33
> sssd_hq.mydc.com.log
>  >> > > >
>  >> > > > Do you want me to attach an other one ?
>  >> > >
>  >> > > No, I just realized that the error happens even before the child is
>  >> > > called. It looks like some unexpected data is received.
>  >> > >
>  >> > > I wonder if you can try to following using gdb after installing the
>  >> sssd
>  >> > > debuginfo file?
>  >> > >
>  >> > >     gdb -p $(pidof sssd_be)
>  >> > >     (gdb) break ad_gpo_parse_machine_ext_names
>  >> > >     (gdb) continue
>  >> > >
>  >> > > try to authenticate while keeping gdb running, whenever gdb show the
>  >> > > prompt again please type
>  >> > >
>  >> > >     (gdb) bt full
>  >> > >     (gdb) continue
>  >> > >
>  >> > > until the authentication finally fails. Please send me the gdb
> output.
>  >> > >
>  >> > > If this won't work for you I can try to prepare an instrumented
> build
>  >> > > for you which writes the needed data into the logs. For this I need
> to
>  >> > > know the exact version of the SSSD package you are using.
>  >> > >
>  >> > > bye,
>  >> > > Sumit
>  >> > >
>  >> > > >
>  >> > > > Thank you by advance.
>  >> > >
>  >> > > > _______________________________________________
>  >> > > > sssd-users mailing list
>  >> > > > sssd-users(a)lists.fedorahosted.org
>  >> > > >
>  >> > >
>  >> https://lists.fedorahosted.org/admin/lists/[e-mail]
>  >> > > _______________________________________________
>  >> > > sssd-users mailing list
>  >> > > sssd-users(a)lists.fedorahosted.org
>  >> > >
>  >> > >
>  >> https://lists.fedorahosted.org/admin/lists/[e-mail]
>  >> > >
>  >>
>  >> > _______________________________________________
>  >> > sssd-users mailing list
>  >> > sssd-users(a)lists.fedorahosted.org
>  >> >
>  >> https://lists.fedorahosted.org/admin/lists/[e-mail]
>  >> _______________________________________________
>  >> sssd-users mailing list
>  >> sssd-users(a)lists.fedorahosted.org
>  >>
>  >> https://lists.fedorahosted.org/admin/lists/[e-mail]
>  >>
>  >
>  > 
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/admin/lists/[e-mail]

[Rolla Matthieu]

No not with samba 4. Will try now but not what's the benefited of it.

On Thursday, 21 April 2016, Sumit Bose <sbose(a)redhat.com&gt; wrote:

>  On Thu, Apr 21, 2016 at 08:28:21AM +0200, Rolla Matthieu wrote:
>  > Solved.
>
>  Everything?
>
>  bye,
>  Sumit
>
>  >
>  > On Thu, Apr 21, 2016 at 7:16 AM, Rolla Matthieu <
>  rolla.matthieu(a)gmail.com <javascript:;>>
>  > wrote:
>  >
>  > > Hello,
>  > >
>  > > I use debian jessy with the testing package for sssd as I did not find
>  a
>  > > version in the backport above 1.12, as I need the GPO functionnality.
>  > >
>  > > The debuginfo seems to be available only with RPM.
>  > >
>  > > However, I configured a 2012 DC and got other issue, some that I could
>  fix
>  > > but I got similar situation with the GPO.
>  > >
>  > > I decided to installed a Centos 7 with sssd and the GPO are working
>  fine.
>  > > I will give a try and build a VM with a new DC with samba 4. Maybe it
>  will
>  > > be better wilt the centos 7.
>  > >
>  > > Just one question, I can authenticate with user@domain, is there a
>  way to
>  > > omit the suffix ( @domain ) ?
>  > >
>  > >
>  > >
>  > > thanks by advance.
>  > >
>  > >
>  > > On Wed, Apr 20, 2016 at 5:43 PM, Sumit Bose <sbose(a)redhat.com
>  <javascript:;>> wrote:
>  > >
>  > >> On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
>  > >> > Hello,
>  > >> >
>  > >> > I think the problem come from my DC and the GPO part. I can install
>  a
>  > >>
>  > >> That's what I'm thinking too. But I expect that the response from
>  your DC
>  > >> is valid but unexpected by SSSD. So it would be good to see what data
>  > >> the DC returned which SSSD failed to parse. The gdb steps below should
>  > >> show this data. If you prefer to just run a test build with additional
>  > >> debug output please let me know which version you currently use.
>  > >>
>  > >> > windows DC to perform test, would you recommend 2008 or 2012 ?
>  > >>
>  > >> I think it is not necessary to perform additional tests here.
>  > >>
>  > >> bye,
>  > >> Sumit
>  > >>
>  > >> >
>  > >> > Thanks by advance.
>  > >> >
>  > >> > On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com
>  <javascript:;>> wrote:
>  > >> >
>  > >> > > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
>  > >> > > > Hello,
>  > >> > > >
>  > >> > > > Thank you for your answer. The file gpo_child is empty :
>  > >> > > >
>  > >> > > > root@gtw-template:/var/log/sssd# ls -ltr
>  > >> > > > total 14656
>  > >> > > > -rw------- 1 root root        0 Apr 19 21:44 gpo_child.log
>  > >> > > > -rw------- 1 root root     3050 Apr 19 23:16 sssd_pam.log
>  > >> > > > -rw------- 1 root root     3050 Apr 19 23:16 sssd_nss.log
>  > >> > > > -rw------- 1 root root    21970 Apr 19 23:22 sssd.log
>  > >> > > > -rw------- 1 root root    49771 Apr 19 23:22 ldap_child.log
>  > >> > > > -rw------- 1 root root   112878 Apr 19 23:22 krb5_child.log
>  > >> > > > -rw------- 1 root root 14800060 Apr 20 00:33
>  sssd_hq.mydc.com.log
>  > >> > > >
>  > >> > > > Do you want me to attach an other one ?
>  > >> > >
>  > >> > > No, I just realized that the error happens even before the child
>  is
>  > >> > > called. It looks like some unexpected data is received.
>  > >> > >
>  > >> > > I wonder if you can try to following using gdb after installing
>  the
>  > >> sssd
>  > >> > > debuginfo file?
>  > >> > >
>  > >> > >     gdb -p $(pidof sssd_be)
>  > >> > >     (gdb) break ad_gpo_parse_machine_ext_names
>  > >> > >     (gdb) continue
>  > >> > >
>  > >> > > try to authenticate while keeping gdb running, whenever gdb show
>  the
>  > >> > > prompt again please type
>  > >> > >
>  > >> > >     (gdb) bt full
>  > >> > >     (gdb) continue
>  > >> > >
>  > >> > > until the authentication finally fails. Please send me the gdb
>  output.
>  > >> > >
>  > >> > > If this won't work for you I can try to prepare an
> instrumented
>  build
>  > >> > > for you which writes the needed data into the logs. For this I
>  need to
>  > >> > > know the exact version of the SSSD package you are using.
>  > >> > >
>  > >> > > bye,
>  > >> > > Sumit
>  > >> > >
>  > >> > > >
>  > >> > > > Thank you by advance.
>  > >> > >
>  > >> > > > _______________________________________________
>  > >> > > > sssd-users mailing list
>  > >> > > > sssd-users(a)lists.fedorahosted.org <javascript:;>
>  > >> > > >
>  > >> > >
>  > >>
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>  > >> > > _______________________________________________
>  > >> > > sssd-users mailing list
>  > >> > > sssd-users(a)lists.fedorahosted.org <javascript:;>
>  > >> > >
>  > >> > >
>  > >>
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>  > >> > >
>  > >>
>  > >> > _______________________________________________
>  > >> > sssd-users mailing list
>  > >> > sssd-users(a)lists.fedorahosted.org <javascript:;>
>  > >> >
>  > >>
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>  > >> _______________________________________________
>  > >> sssd-users mailing list
>  > >> sssd-users(a)lists.fedorahosted.org <javascript:;>
>  > >>
>  > >>
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>  > >>
>  > >
>  > >
>
>  > _______________________________________________
>  > sssd-users mailing list
>  > sssd-users(a)lists.fedorahosted.org <javascript:;>
>  >
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org <javascript:;>
>
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>

[Rolla Matthieu]

Hello Sumit,

Please find attach the trace as requested.

I use debian 8 with sernet SAMBA 4 , backend bind_DLZ. POSIX attributs are
active and working.

Regarding SSSD:

It's running on the last Centos 7. here are the packages :

[root@gtwdcsmb ~]# rpm -qa | grep -E "sssd|realm"
sssd-client-1.13.0-40.el7_2.2.x86_64
sssd-common-pac-1.13.0-40.el7_2.2.x86_64
sssd-krb5-1.13.0-40.el7_2.2.x86_64
sssd-debuginfo-1.13.0-40.el7_2.2.x86_64
python-sssdconfig-1.13.0-40.el7_2.2.noarch
sssd-krb5-common-1.13.0-40.el7_2.2.x86_64
sssd-ipa-1.13.0-40.el7_2.2.x86_64
sssd-ldap-1.13.0-40.el7_2.2.x86_64
sssd-proxy-1.13.0-40.el7_2.2.x86_64
realmd-0.16.1-5.el7.x86_64
sssd-common-1.13.0-40.el7_2.2.x86_64
sssd-ad-1.13.0-40.el7_2.2.x86_64
sssd-1.13.0-40.el7_2.2.x86_64


Also, regarding sssd,  DNS registration ( forward and reverse ) and the
registration of the computer in a specific OU with realm are working when
sssd is starting. Or when a Machine is joining the Domain.

Currently, Authenfication is working but the GPO are not applicated /
called. Same as prviously, things gpo_child.log is not growing and the GPO
does not seems to be called...

I hope the trace will help you to identify the source of the problem.

As I mention earlier, as a test, I also setup a POC with windows 2012 as
DC. SSSD is working without problem, GPO too.

If you need anything else please let me know and thank for your help.



On Thu, Apr 21, 2016 at 1:41 PM, Rolla Matthieu <rolla.matthieu(a)gmail.com&gt;
wrote:

>  No not with samba 4. Will try now but not what's the benefited of
> it.
>
>
>  On Thursday, 21 April 2016, Sumit Bose <sbose(a)redhat.com&gt; wrote:
>
> > On Thu, Apr 21, 2016 at 08:28:21AM +0200, Rolla Matthieu wrote:
> > > Solved.
> >
> > Everything?
> >
> > bye,
> > Sumit
> >
> > >
> > > On Thu, Apr 21, 2016 at 7:16 AM, Rolla Matthieu <
> > rolla.matthieu(a)gmail.com&gt;
> > > wrote:
> > >
> > > > Hello,
> > > >
> > > > I use debian jessy with the testing package for sssd as I did not
> > find a
> > > > version in the backport above 1.12, as I need the GPO functionnality.
> > > >
> > > > The debuginfo seems to be available only with RPM.
> > > >
> > > > However, I configured a 2012 DC and got other issue, some that I
> > could fix
> > > > but I got similar situation with the GPO.
> > > >
> > > > I decided to installed a Centos 7 with sssd and the GPO are working
> > fine.
> > > > I will give a try and build a VM with a new DC with samba 4. Maybe it
> > will
> > > > be better wilt the centos 7.
> > > >
> > > > Just one question, I can authenticate with user@domain, is there a
> > way to
> > > > omit the suffix ( @domain ) ?
> > > >
> > > >
> > > >
> > > > thanks by advance.
> > > >
> > > >
> > > > On Wed, Apr 20, 2016 at 5:43 PM, Sumit Bose <sbose(a)redhat.com&gt;
> wrote:
> > > >
> > > >> On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
> > > >> > Hello,
> > > >> >
> > > >> > I think the problem come from my DC and the GPO part. I can
> > install a
> > > >>
> > > >> That's what I'm thinking too. But I expect that the response
> from
> > your DC
> > > >> is valid but unexpected by SSSD. So it would be good to see what data
> > > >> the DC returned which SSSD failed to parse. The gdb steps below
> > should
> > > >> show this data. If you prefer to just run a test build with
> > additional
> > > >> debug output please let me know which version you currently use.
> > > >>
> > > >> > windows DC to perform test, would you recommend 2008 or 2012 ?
> > > >>
> > > >> I think it is not necessary to perform additional tests here.
> > > >>
> > > >> bye,
> > > >> Sumit
> > > >>
> > > >> >
> > > >> > Thanks by advance.
> > > >> >
> > > >> > On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose
> <sbose(a)redhat.com&gt;
> > wrote:
> > > >> >
> > > >> > > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu
> wrote:
> > > >> > > > Hello,
> > > >> > > >
> > > >> > > > Thank you for your answer. The file gpo_child is empty
> :
> > > >> > > >
> > > >> > > > root@gtw-template:/var/log/sssd# ls -ltr
> > > >> > > > total 14656
> > > >> > > > -rw------- 1 root root        0 Apr 19 21:44
> gpo_child.log
> > > >> > > > -rw------- 1 root root     3050 Apr 19 23:16
> sssd_pam.log
> > > >> > > > -rw------- 1 root root     3050 Apr 19 23:16
> sssd_nss.log
> > > >> > > > -rw------- 1 root root    21970 Apr 19 23:22 sssd.log
> > > >> > > > -rw------- 1 root root    49771 Apr 19 23:22
> ldap_child.log
> > > >> > > > -rw------- 1 root root   112878 Apr 19 23:22
> krb5_child.log
> > > >> > > > -rw------- 1 root root 14800060 Apr 20 00:33
> > sssd_hq.mydc.com.log
> > > >> > > >
> > > >> > > > Do you want me to attach an other one ?
> > > >> > >
> > > >> > > No, I just realized that the error happens even before the
> child
> > is
> > > >> > > called. It looks like some unexpected data is received.
> > > >> > >
> > > >> > > I wonder if you can try to following using gdb after
> installing
> > the
> > > >> sssd
> > > >> > > debuginfo file?
> > > >> > >
> > > >> > >     gdb -p $(pidof sssd_be)
> > > >> > >     (gdb) break ad_gpo_parse_machine_ext_names
> > > >> > >     (gdb) continue
> > > >> > >
> > > >> > > try to authenticate while keeping gdb running, whenever gdb
> show
> > the
> > > >> > > prompt again please type
> > > >> > >
> > > >> > >     (gdb) bt full
> > > >> > >     (gdb) continue
> > > >> > >
> > > >> > > until the authentication finally fails. Please send me the
> gdb
> > output.
> > > >> > >
> > > >> > > If this won't work for you I can try to prepare an
> instrumented
> > build
> > > >> > > for you which writes the needed data into the logs. For this
> I
> > need to
> > > >> > > know the exact version of the SSSD package you are using.
> > > >> > >
> > > >> > > bye,
> > > >> > > Sumit
> > > >> > >
> > > >> > > >
> > > >> > > > Thank you by advance.
> > > >> > >
> > > >> > > > _______________________________________________
> > > >> > > > sssd-users mailing list
> > > >> > > > sssd-users(a)lists.fedorahosted.org
> > > >> > > >
> > > >> > >
> > > >>
> > https://lists.fedorahosted.org/admin/lists/[e-mail]
> > > >> > > _______________________________________________
> > > >> > > sssd-users mailing list
> > > >> > > sssd-users(a)lists.fedorahosted.org
> > > >> > >
> > > >> > >
> > > >>
> > https://lists.fedorahosted.org/admin/lists/[e-mail]
> > > >> > >
> > > >>
> > > >> > _______________________________________________
> > > >> > sssd-users mailing list
> > > >> > sssd-users(a)lists.fedorahosted.org
> > > >> >
> > > >>
> > https://lists.fedorahosted.org/admin/lists/[e-mail]
> > > >> _______________________________________________
> > > >> sssd-users mailing list
> > > >> sssd-users(a)lists.fedorahosted.org
> > > >>
> > > >>
> > https://lists.fedorahosted.org/admin/lists/[e-mail]
> > > >>
> > > >
> > > >
> >
> > > _______________________________________________
> > > sssd-users mailing list
> > > sssd-users(a)lists.fedorahosted.org
> > >
> > https://lists.fedorahosted.org/admin/lists/[e-mail]
> > _______________________________________________
> > sssd-users mailing list
> > sssd-users(a)lists.fedorahosted.org
> >
> > https://lists.fedorahosted.org/admin/lists/[e-mail]
> >
>

[Rolla Matthieu]

So I think the problem is persisting. I managed to make work samba 4 as a DC with full
replication. 

When starting sssd even the dns update is working against samba 4 bind_dlz backend.
However the GPO are still skipped. 

Regarding the configuration, I changed it a bit : 

[sssd]
domains = mydc.com
config_file_version = 2
services = nss, pam

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3

[pam]
reconnection_retries = 3

[domain/mydc.com]
debug_level = 10
ldap_schema = ad
ad_domain = mydc.com
dyndns_server = dc01.mydc.com
ad_server = dc01.unity3d.com
krb5_realm = UNITY3D.COM
ad_gpo_access_control = enforcing
ad_gpo_map_service = +openvpn
#krb5_use_enterprise_principal = false
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
access_provider = ad

By specifying AD for ldap_scheme (as I use samba4 sernet), now I can found my users
correctly using POSIX. I also manage by setting "us_fully_quilifield_names" to
False to get a proper list of the groups for a users or when checking with "id"
command.example : 

[user3@gtwdcsmb ~]$ id
uid=15001(user3) gid=10000(domain users) groups=10000(domain users),10004(not_allow)
[user3@gtwdcsmb ~]$


Here is the Debug as requested, you will also fin the log associated.  I recreated them
before doing the dbg

dbg as requested : http://pastebin.com/usijYbFE

log associated : 

[root@gtwdcsmb sssd]# ls -ltr
total 492
-rw------- 1 root root  15766 Apr 24 11:27 ldap_child.log
-rw------- 1 root root  15015 Apr 24 11:27 krb5_child.log
-rw------- 1 root root      0 Apr 24 11:27 gpo_child.log
-rw------- 1 root root    128 Apr 24 11:29 sssd.log
-rw------- 1 root root    826 Apr 24 11:32 sssd_pam.log
-rw------- 1 root root    826 Apr 24 11:32 sssd_nss.log
-rw------- 1 root root 255234 Apr 24 11:33 sssd_mydc.com.log


ldap_child.log : http://pastebin.com/3qk2RPma
krb5_child.log : http://pastebin.com/5GDskCJN
gpo_child.log : empty
sssd_mydc.com.log : http://pastebin.com/4yHUXRZ3



Here is the version that I use : 
The VM with SSSD : 

[root@gtwdcsmb sssd]# uname -a
Linux gtwdcsmb.unity3d.com 3.10.0-327.13.1.el7.x86_64 #1 SMP Thu Mar 31 16:04:38 UTC 2016
x86_64 x86_64 x86_64 GNU/Linux

[root@gtwdcsmb sssd]# cat /etc/redhat-release
CentOS Linux release 7.2.1511 (Core)

[root@gtwdcsmb sssd]# rpm -qa | grep sssd
sssd-client-1.13.0-40.el7_2.2.x86_64
sssd-common-pac-1.13.0-40.el7_2.2.x86_64
sssd-krb5-1.13.0-40.el7_2.2.x86_64
python-sssdconfig-1.13.0-40.el7_2.2.noarch
sssd-krb5-common-1.13.0-40.el7_2.2.x86_64
sssd-ipa-1.13.0-40.el7_2.2.x86_64
sssd-ldap-1.13.0-40.el7_2.2.x86_64
sssd-proxy-1.13.0-40.el7_2.2.x86_64
sssd-common-1.13.0-40.el7_2.2.x86_64
sssd-ad-1.13.0-40.el7_2.2.x86_64
sssd-1.13.0-40.el7_2.2.x86_64
sssd-debuginfo-1.13.0-40.el7_2.2.x86_64

The VM with Samba: 

root@dc01:~# cat /etc/debian_version
8.4

root@dc01:~# uname -a
Linux dc01 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt25-2 (2016-04-08) x86_64 GNU/Linux

root@dc01:~# dpkg -l |grep samba
ii  libwbclient0:amd64               99:4.3.8-11                 amd64        Glue package
for sernet-samba-libs.
ii  samba-common                     99:4.3.8-11                 all          Glue package
for sernet-samba-common.
rc  samba-libs:amd64                 2:4.2.10+dfsg-0+deb8u2      amd64        Samba core
libraries
ii  sernet-samba                     99:4.3.8-11                 amd64        SMB/CIFS
file, print, and login server for Unix
ii  sernet-samba-ad                  99:4.3.8-11                 amd64        Samba Active
Directory Domain Controller
ii  sernet-samba-client              99:4.3.8-11                 amd64        a
LanManager-like simple client for Unix
ii  sernet-samba-common              99:4.3.8-11                 all          Samba common
files used by both the server and the client
ii  sernet-samba-libs:amd64          99:4.3.8-11                 amd64        Samba common
library files used by both the server and the client
ii  sernet-samba-libsmbclient0:amd64 99:4.3.8-11                 amd64        Shared
library that allows applications to talk to SMB servers
ii  sernet-samba-winbind             99:4.3.8-11                 amd64        Samba
nameservice integration server

Thanks you again for your help . :D

[Sumit Bose]

On Sat, Apr 23, 2016 at 01:48:54PM +0200, Rolla Matthieu wrote:
>  Hello Sumit,
>  
>  Please find attach the trace as requested.
>  
>  I use debian 8 with sernet SAMBA 4 , backend bind_DLZ. POSIX attributs are
>  active and working.
>  
>  Regarding SSSD:
>  
>  It's running on the last Centos 7. here are the packages :
>  
>  [root@gtwdcsmb ~]# rpm -qa | grep -E "sssd|realm"
>  sssd-client-1.13.0-40.el7_2.2.x86_64
>  sssd-common-pac-1.13.0-40.el7_2.2.x86_64
>  sssd-krb5-1.13.0-40.el7_2.2.x86_64
>  sssd-debuginfo-1.13.0-40.el7_2.2.x86_64
>  python-sssdconfig-1.13.0-40.el7_2.2.noarch
>  sssd-krb5-common-1.13.0-40.el7_2.2.x86_64
>  sssd-ipa-1.13.0-40.el7_2.2.x86_64
>  sssd-ldap-1.13.0-40.el7_2.2.x86_64
>  sssd-proxy-1.13.0-40.el7_2.2.x86_64
>  realmd-0.16.1-5.el7.x86_64
>  sssd-common-1.13.0-40.el7_2.2.x86_64
>  sssd-ad-1.13.0-40.el7_2.2.x86_64
>  sssd-1.13.0-40.el7_2.2.x86_64
>  
>  
>  Also, regarding sssd,  DNS registration ( forward and reverse ) and the
>  registration of the computer in a specific OU with realm are working when
>  sssd is starting. Or when a Machine is joining the Domain. 
SSSD tries to run a dynamic DNS update whenever it goes online, i.e. at
startup and at runtime when the configured servers show up in the
network again.

>  
>  Currently, Authenfication is working but the GPO are not applicated /
>  called. Same as prviously, things gpo_child.log is not growing and the GPO
>  does not seems to be called...
>  
>  I hope the trace will help you to identify the source of the problem.
>  
>  As I mention earlier, as a test, I also setup a POC with windows 2012 as
>  DC. SSSD is working without problem, GPO too.
>  
>  If you need anything else please let me know and thank for your help.
>  
>  
>   
...

>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]]
> [ad_gpo_filter_gpos_by_dacl] (0x4000): examining dacl
> candidate_gpo_guid:{31B2F340-016D-11D2-945F-00C04FB984F9}
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000):
> GPO not applicable to target per security filtering
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000):
> examining dacl candidate_gpo_guid:{5C320202-3B01-4865-B495-395BD580B315}
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000):
> GPO applicable to target per security filtering
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_process_gpo_done] (0x0400):
> dacl_filtered_gpos[0]->gpo_guid is {5C320202-3B01-4865-B495-395BD580B315}
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_cse_guid]
> (0x4000): examining cse candidate_gpo_guid: {5C320202-3B01-4865-B495-395BD580B315}
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_cse_guid]
> (0x4000): GPO applicable to target per cse_guid filtering
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_process_gpo_done] (0x0400):
> cse_filtered_gpos[0]->gpo_guid is {5C320202-3B01-4865-B495-395BD580B315}
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_process_gpo_done] (0x0400):
> num_cse_filtered_gpos: 1
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): start ldb transaction
> (nesting: 0)
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_result_object]
> (0x4000): cn=gpos,cn=ad,cn=custom,cn=mydc.com,cn=sysdb
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
> "ltdb_callback": 0x7f2f84015c90
>  
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
> "ltdb_timeout": 0x7f2f84009f00
>  
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Running timer event
> 0x7f2f84015c90 "ltdb_callback"
>  
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Destroying timer event
> 0x7f2f84009f00 "ltdb_timeout"
>  
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Ending timer event
> 0x7f2f84015c90 "ltdb_callback"
>  
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_result_object]
> (0x4000): No GPO Result object.
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): commit ldb transaction
> (nesting: 0)
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): cse
> filtered_gpos[0]->gpo_guid is {5C320202-3B01-4865-B495-395BD580B315}
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x4000):
> cse_filtered_gpos[0]->gpo_cse_guids[0]->gpo_guid is
> {827D319E-6EAC-11D2-A4EA-00C04F79F83A}
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): smb_server:
> smb://DC02.mydc.com
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): smb_share:
> /SysVol
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): smb_path:
> /mydc.com/Policies/{5C320202-3B01-4865-B495-395BD580B315}
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): gpo_guid:
> {5C320202-3B01-4865-B495-395BD580B315}
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): retrieving
> GPO from cache [{5C320202-3B01-4865-B495-395BD580B315}]
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_by_guid] (0x4000):
> cn=gpos,cn=ad,cn=custom,cn=mydc.com,cn=sysdb
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
> "ltdb_callback": 0x7f2f84009f80
>  
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
> "ltdb_timeout": 0x7f2f8400b290
>  
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Running timer event
> 0x7f2f84009f80 "ltdb_callback"
>  
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Destroying timer event
> 0x7f2f8400b290 "ltdb_timeout"
>  
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Ending timer event
> 0x7f2f84009f80 "ltdb_callback"
>  
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_by_guid] (0x4000): No
> such entry.
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): ENOENT
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400):
> send_to_child: 1
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400):
> cached_gpt_version: -1
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [create_cse_send_buffer] (0x4000): buffer
> size: 158
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_handler_setup] (0x2000): Setting
> up signal handler up for pid [4243]
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_handler_setup] (0x2000): Signal
> handler set up for pid [4243]
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sdap_process_result] (0x2000): Trace:
> sh[0x7f2f83fcae70], connected[1], ops[(nil)], ldap[0x7f2f83f91be0]
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sdap_process_result] (0x2000): Trace:
> ldap_result found nothing!
>  (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [write_pipe_handler] (0x0400): All data
> has been sent!
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0400): gpo_child started.
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0400): context
> initialized
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x0400):
> cached_gpt_version: -1
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_server
> length: 22
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000):
> smb_server: smb://DC02.mydc.com
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_share
> length: 7
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_share:
> /SysVol
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_path
> length: 60
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_path:
> /mydc.com/Policies/{5C320202-3B01-4865-B495-395BD580B315}
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000):
> smb_cse_suffix length: 49
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000):
> smb_cse_suffix: /Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0400): performing smb
> operations
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [copy_smb_file_to_gpo_cache]
> (0x0400): smb_uri:
> smb://DC02.mydc.com/SysVol/mydc.com/Policies/{5C320202-3B01-4865-B495-395...
>  (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [copy_smb_file_to_gpo_cache]
> (0x0020): smbc_getFunctionOpen failed [2][No such file or directory] 
If I understood it correctly DC02.mydc.com is a Samba4 DC. Does it
provide a SysVol share which contains the gpo file
/mydc.com/Policies/{5C320202-3B01-4865-B495-395BD580B315}/GPT.INI ?

bye,
Sumit

> (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [perform_smb_operations]
(0x0020): copy_smb_file_to_gpo_cache failed [2][No such file or directory]
> (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0020):
perform_smb_operations failed.[2][No such file or directory].
> (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0020): gpo_child
failed!
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [read_pipe_handler] (0x0400): EOF
received, client finished
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [gpo_cse_done] (0x0020):
ad_gpo_parse_gpo_child_response failed: [22][Invalid argument]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_done] (0x0400): gpo_guid:
{5C320202-3B01-4865-B495-395BD580B315}
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_done] (0x0040): Unable to
retrieve policy data: [22](Invalid argument}
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_access_done] (0x0040):
GPO-based access control failed.
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_access_done] (0x0040):
Ignoring error: [22](Invalid argument); GPO-based access control failed, but GPO is not in
enforcing mode.
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0100):
Backend returned: (0, 0, <NULL>) [Success (Success)]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0400):
SELinux provider doesn't exist, not sending the request to it.
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0100):
Sending result [0][mydc.COM]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0100):
Sent result [0][mydc.COM]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_sig_handler] (0x1000): Waiting
for child [4243].
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_sig_handler] (0x0020): child
[4243] failed with status [1].
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [sbus_remove_timeout] (0x2000):
0x7ffaccc16a20
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn:
0x7ffaccc0f810
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching.
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [pam_dp_process_reply] (0x0200): received: [0
(Success)][mydc.COM]
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with
result [0]: Success.
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 28