cache or return Problem

[Günther J. Niederwimmer]

Hello,

Is it possible to found out, what sssd have in the cache or send back to a 
program  like dovecot from a IPA Server?

My dovecot can't find the correct uid, gid to a mail address from Ipa?

-- 
mit freundlichen Grüssen / best regards,

 Günther J. Niederwimmer

[Jakub Hrozek]

On Tue, Jun 16, 2015 at 10:00:17AM +0200, Günther J. Niederwimmer wrote:
>  Hello,
>  
>  Is it possible to found out, what sssd have in the cache or send back to a 
>  program  like dovecot from a IPA Server? 
yes, with ldb-tools

>  
>  My dovecot can't find the correct uid, gid to a mail address from Ipa? 
Have you already followed
https://fedorahosted.org/sssd/wiki/Troubleshooting ?

[Günther J. Niederwimmer]

Hello Jacub,

Am Dienstag, 16. Juni 2015, 10:11:27 schrieb Jakub Hrozek:
>  On Tue, Jun 16, 2015 at 10:00:17AM +0200, Günther J. Niederwimmer
> wrote:
>  > Hello,
>  > 
>  > Is it possible to found out, what sssd have in the cache or send back to a
>  > program  like dovecot from a IPA Server?
>  
>  yes, with ldb-tools 
Thanks for the answer.

 
>  > My dovecot can't find the correct uid, gid to a mail address
> from Ipa? 
 
>  Have you already followed
>  https://fedorahosted.org/sssd/wiki/Troubleshooting ? 
Yes :-(.


One of my Problem is, I have with IPA configured a user with two or more EMail 
Adresses, the result is correct with the first address the "domain" address.

IPA / LDAP / KRB5 is configured with 4gjn.prv.

This address is resolving with getent passwd gjn(a)4gjn.prv or "gjn"

gjn:*:1586800001:1586800001:Günther x. XXXXXXXXXXXXX:/home/gjn:/bin/bash

but with the second address, this is never found?

when I make a getent passwd gjn(a)4gjn.com I have this logs in the nss log.

//
(Tue Jun 16 11:19:32 2015) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting 
info for [gjn] from [4gjn.prv]
(Tue Jun 16 11:19:32 2015) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): 
Requesting info for [gjn(a)4gjn.prv]
(Tue Jun 16 11:19:32 2015) [sssd[nss]] [client_recv] (0x0200): Client 
disconnected!
(Tue Jun 16 11:19:45 2015) [sssd[nss]] [sss_cmd_get_version] (0x0200): 
Received client version [1].
(Tue Jun 16 11:19:45 2015) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered 
version [1].
(Tue Jun 16 11:19:45 2015) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): 
Requesting info for [[e-mail](a)4gjn.prv]
(Tue Jun 16 11:19:45 2015) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): 
Unable to get information from Data Provider
Error: 3, 0, Account info lookup failed
Will try to return what we have in cache
(Tue Jun 16 11:19:45 2015) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): 
Requesting info for [[e-mail](a)4gjn.prv]
                               ___________________________


(Tue Jun 16 11:19:45 2015) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0040): No 
results for getpwnam call
(Tue Jun 16 11:19:45 2015) [sssd[nss]] [client_recv] (0x0200): Client 
disconnected!
(Tue Jun 16 11:20:01 2015) [sssd[nss]] [sss_cmd_get_version] (0x0200): 
Received client version [1].
(Tue Jun 16 11:20:01 2015) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered 
version [1].
(Tue Jun 16 11:20:01 2015) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): 
name 'root' matched wi
//


Is this a problem on my config or a Bug ?

-- 
mit freundlichen Grüssen / best regards,

 Günther J. Niederwimmer

[Jakub Hrozek]

On Tue, Jun 16, 2015 at 11:48:32AM +0200, Günther J. Niederwimmer wrote:
>  Hello Jacub,
>  
>  Am Dienstag, 16. Juni 2015, 10:11:27 schrieb Jakub Hrozek:
>  > On Tue, Jun 16, 2015 at 10:00:17AM +0200, Günther J. Niederwimmer wrote:
>  > > Hello,
>  > > 
>  > > Is it possible to found out, what sssd have in the cache or send back to a
>  > > program  like dovecot from a IPA Server?
>  > 
>  > yes, with ldb-tools
>  
>  Thanks for the answer.
>  
>   
>  > > My dovecot can't find the correct uid, gid to a mail address from Ipa?
>   
>  > Have you already followed
>  > https://fedorahosted.org/sssd/wiki/Troubleshooting ?
>  Yes :-(.
>  
>  
>  One of my Problem is, I have with IPA configured a user with two or more EMail 
>  Adresses, the result is correct with the first address the "domain" address.
I think this is more or less a confusion. The Name Service Switch
interface (which you call into when you do "getent passwd $name") only
supports lookup by username or Kerberos Principal name (aka UPN).

The username can be qualified with the name of the domain the user
belongs to. That's what happens when you call gjn(a)4gjn.prv, I assume
your domain is in fact called 4gjn.prv

What is the use-case you're trying to achieve? Why do you need a lookup
by e-mail?

[Günther J. Niederwimmer]

Hello Jacub,

Am Dienstag, 16. Juni 2015, 11:57:34 schrieb Jakub Hrozek:
>  On Tue, Jun 16, 2015 at 11:48:32AM +0200, Günther J. Niederwimmer
> wrote:
>  > Hello Jacub,
>  > 
>  > Am Dienstag, 16. Juni 2015, 10:11:27 schrieb Jakub Hrozek:
>  > > On Tue, Jun 16, 2015 at 10:00:17AM +0200, Günther J. Niederwimmer wrote:
>  > > > Hello,
>  > > > 
>  > > > Is it possible to found out, what sssd have in the cache or send back
>  > > > to a
>  > > > program  like dovecot from a IPA Server?
>  > > 
>  > > yes, with ldb-tools
>  > 
>  > Thanks for the answer.
>  > 
>  > > > My dovecot can't find the correct uid, gid to a mail address from
> Ipa?
>  > > 
>  > > Have you already followed
>  > > https://fedorahosted.org/sssd/wiki/Troubleshooting ?
>  > 
>  > Yes :-(.
>  > 
>  > 
>  > One of my Problem is, I have with IPA configured a user with two or more
>  > EMail Adresses, the result is correct with the first address the "domain"
>  > address.
>  I think this is more or less a confusion. The Name Service Switch
>  interface (which you call into when you do "getent passwd $name") only
>  supports lookup by username or Kerberos Principal name (aka UPN). 
I mean I have more then one confusion. :-)
 
>  The username can be qualified with the name of the domain the user
>  belongs to. That's what happens when you call gjn(a)4gjn.prv, I assume
>  your domain is in fact called 4gjn.prv 
Yes. this is a Test System to test and learn more over sssd and IPA
 
>  What is the use-case you're trying to achieve? Why do you need a
> lookup
>  by e-mail? 
I like to integrate a postfix and dovecot system with IPA users, bur the most 
user have more then one EMail-Address?

Now I mean this is only possible with a direct access to the ldap (389) / IPA 
DataBase?


The bad situation I can't configure this manual, I can't found the correct 
parameter for "389" :-(.

-- 
mit freundlichen Grüssen / best regards,

 Günther J. Niederwimmer

[Jakub Hrozek]

On Tue, Jun 16, 2015 at 12:27:09PM +0200, Günther J. Niederwimmer wrote:
>  Hello Jacub,
>  
>  Am Dienstag, 16. Juni 2015, 11:57:34 schrieb Jakub Hrozek:
>  > On Tue, Jun 16, 2015 at 11:48:32AM +0200, Günther J. Niederwimmer wrote:
>  > > Hello Jacub,
>  > > 
>  > > Am Dienstag, 16. Juni 2015, 10:11:27 schrieb Jakub Hrozek:
>  > > > On Tue, Jun 16, 2015 at 10:00:17AM +0200, Günther J. Niederwimmer wrote:
>  > > > > Hello,
>  > > > > 
>  > > > > Is it possible to found out, what sssd have in the cache or send
> back
>  > > > > to a
>  > > > > program  like dovecot from a IPA Server?
>  > > > 
>  > > > yes, with ldb-tools
>  > > 
>  > > Thanks for the answer.
>  > > 
>  > > > > My dovecot can't find the correct uid, gid to a mail address from
> Ipa?
>  > > > 
>  > > > Have you already followed
>  > > > https://fedorahosted.org/sssd/wiki/Troubleshooting ?
>  > > 
>  > > Yes :-(.
>  > > 
>  > > 
>  > > One of my Problem is, I have with IPA configured a user with two or more
>  > > EMail Adresses, the result is correct with the first address the
> "domain"
>  > > address.
>  > I think this is more or less a confusion. The Name Service Switch
>  > interface (which you call into when you do "getent passwd $name") only
>  > supports lookup by username or Kerberos Principal name (aka UPN).
>  
>  I mean I have more then one confusion. :-)
>   
>  > The username can be qualified with the name of the domain the user
>  > belongs to. That's what happens when you call gjn(a)4gjn.prv, I assume
>  > your domain is in fact called 4gjn.prv
>  
>  Yes. this is a Test System to test and learn more over sssd and IPA
>   
>  > What is the use-case you're trying to achieve? Why do you need a lookup
>  > by e-mail?
>  
>  I like to integrate a postfix and dovecot system with IPA users, bur the most 
>  user have more then one EMail-Address?
>  
>  Now I mean this is only possible with a direct access to the ldap (389) / IPA 
>  DataBase? 
If the system you're interacting with looks up the users by e-mail
address, then they'd need to access the database.

We also have a D-Bus API in the recent versions of SSSD, but I doubt
dovecot can use that API.

>  
>  
>  The bad situation I can't configure this manual, I can't found the correct 
>  parameter for "389" :-(. 
There are users on the freeipa-users mailing list who configured dovecot
with IPA integration, asking there might be helpful.