Issue #2930: User found in AD but authentication fails - sssd

SSSD / sssd

#2930 User found in AD but authentication fails

Closed: Invalid Opened Jan 18, 2016 by mferon.

Hello all.
I'm trying to setup a ldap against AD authentication. I've installed SSSD 1.12.4
OS: Red Hat Enterprise Linux Server release 6.2 (Santiago)
In the logs, my search brings back the user but the final result fails in not found.

for testing I use 'id WXYZ123'

A ldapsearch works fine.

I've tried to set ldap_id_mapping = false to true but the request is completed with a ((null=*)) AND condition => so it fails each time

I've already spent 5 days and getting crazy. I've googled a lot but don't found any answer, except the https://fedorahosted.org/sssd/ticket/2666 ticket.

A great thanks to any help you could bring to me
Happy new year!

PS: I'm french and didn't practice english writing for a long time, sorry :) )

(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_print_server] (0x2000): Searching XXX.XXX.XXX.XXX
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=WXYZ123)(objectclass=user)(sAMAccountName=*)(&(objectSid=*)(!(objectSid=0))))][OU=RessLocales,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr].
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSid]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectGUID]
[...]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sshPublicKey]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 3
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_id_op_connect_done] (0x4000): caching successful connection after 1 notifies
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [be_run_unconditional_online_cb] (0x4000): List of unconditional online callbacks is empty, nothing to do.
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[0x10e5d90], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[0x10e5d90], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=FERON Matthieu,OU=Utilisateurs,OU=MainOU,OU=RessLocales,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr].
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [cn]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [memberOf]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectGUID]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [userAccountControl]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [accountExpires]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimeStamp]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[0x10e5d90], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results.

Great, I found myself!

(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_search_user_process] (0x4000): Retrieved total 1 users
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [ldb] (0x4000): start ldb transaction (nesting: 0)
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_save_user] (0x0400): Save user
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_attrs_get_sid_str] (0x1000): No [objectSID] attribute. [0][Success]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_save_user] (0x4000): objectSID: not available for user
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_primary_name] (0x0400): Processing object XORC529
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_save_user] (0x0400): Processing user XORC529
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [ldb] (0x4000): commit ldb transaction (nesting: 0)
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_users_done] (0x4000): Saving 1 Users - Done
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_id_op_done] (0x4000): releasing operation connection
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[(nil)], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!

Whu ??

(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_dispatch] (0x4000): dbus conn: 0x10c2670
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_dispatch] (0x4000): Dispatching.
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_message_handler] (0x4000): Received SBUS method [ping]
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [ping]

Here is my sssd.conf

[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = mydomain.fr
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/mydomain.fr]
debug_level = 0x7700
cache_credentials = False
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
ldap_uri = ldap://XXX.XXX.XXX.XXX
ldap_id_mapping = false
ldap_schema = rfc2307bis
ldap_referrals = False
ldap_search_base = OU=RessLocales,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr
ldap_user_search_base = OU=RessLocales,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr
ldap_user_object_class = user
ldap_group_search_base = OU=Users,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr
ldap_group_object_class = group
ldap_user_name = sAMAccountName
ldap_user_uid_number = objectSid
ldap_user_gid_number = objectGUID
ldap_user_home_directory = unixHomeDirectory
ldap_user_member_of = memberOf
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = True
ldap_id_use_start_tls = False
ldap_user_member_of = memberOf
ldap_default_bind_dn = CN=AllowedToBindUSer,OU=Services,OU=OtherOU,OU=Applications,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr
ldap_default_authtok_type = password
ldap_default_authtok = MySecretPassword
ldap_tls_cacertdir = /etc/openldap/cacerts

My krb5.conf

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
[libdefaults]
 default_realm = MYDOMAIN.FR
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
[realms]
 MYDOMAIN.FR  = {
  kdc = XXX.XXX.XXX.XXX
  admin_server = XXX.XXX.XXX.XXX
 }
[domain_realm]
 .mydomain.fr = MYDOMAIN.FR
 mydomain.fr = MYDOMAIN.FR

lslebodn commented Jan 18, 2016

Fields changed

description: Hello all.
I'm trying to setup a ldap against AD authentication. I've installed SSSD 1.12.4
OS: Red Hat Enterprise Linux Server release 6.2 (Santiago)
In the logs, my search brings back the user but the final result fails in not found.

for testing I use 'id WXYZ123'

A ldapsearch works fine.

I've tried to set ldap_id_mapping = false to true but the request is completed with a ((null=*)) AND condition => so it fails each time

I've already spent 5 days and getting crazy. I've googled a lot but don't found any answer, except the https://fedorahosted.org/sssd/ticket/2666 ticket.

A great thanks to any help you could bring to me
Happy new year!

PS: I'm french and didn't practice english writing for a long time, sorry :) )

(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_print_server] (0x2000): Searching XXX.XXX.XXX.XXX
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=WXYZ123)(objectclass=user)(sAMAccountName=)(&(objectSid=)(!(objectSid=0))))][OU=RessLocales,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr].
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSid]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectGUID]
[...]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sshPublicKey]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 3
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_id_op_connect_done] (0x4000): caching successful connection after 1 notifies
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [be_run_unconditional_online_cb] (0x4000): List of unconditional online callbacks is empty, nothing to do.
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[0x10e5d90], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[0x10e5d90], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=FERON Matthieu,OU=Utilisateurs,OU=MainOU,OU=RessLocales,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr].
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [cn]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [memberOf]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectGUID]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [userAccountControl]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [accountExpires]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimeStamp]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[0x10e5d90], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results.

Great, I found myself!

(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_search_user_process] (0x4000): Retrieved total 1 users
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [ldb] (0x4000): start ldb transaction (nesting: 0)
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_save_user] (0x0400): Save user
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_attrs_get_sid_str] (0x1000): No [objectSID] attribute. [0][Success]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_save_user] (0x4000): objectSID: not available for user
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_primary_name] (0x0400): Processing object XORC529
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_save_user] (0x0400): Processing user XORC529
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [ldb] (0x4000): commit ldb transaction (nesting: 0)
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_users_done] (0x4000): Saving 1 Users - Done
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_id_op_done] (0x4000): releasing operation connection
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[(nil)], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!

Whu ??

(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_dispatch] (0x4000): dbus conn: 0x10c2670
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_dispatch] (0x4000): Dispatching.
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_message_handler] (0x4000): Received SBUS method [ping]
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [ping]

Here is my sssd.conf
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = mydomain.fr

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3

[pam]
reconnection_retries = 3

[domain/mydomain.fr]
debug_level = 0x7700
cache_credentials = False
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
ldap_uri = ldap://XXX.XXX.XXX.XXX
ldap_id_mapping = false
ldap_schema = rfc2307bis
ldap_referrals = False
ldap_search_base = OU=RessLocales,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr
ldap_user_search_base = OU=RessLocales,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr
ldap_user_object_class = user
ldap_group_search_base = OU=Users,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr
ldap_group_object_class = group
ldap_user_name = sAMAccountName
ldap_user_uid_number = objectSid
ldap_user_gid_number = objectGUID
ldap_user_home_directory = unixHomeDirectory
ldap_user_member_of = memberOf
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = True
ldap_id_use_start_tls = False
ldap_user_member_of = memberOf
ldap_default_bind_dn = CN=AllowedToBindUSer,OU=Services,OU=OtherOU,OU=Applications,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr
ldap_default_authtok_type = password
ldap_default_authtok = MySecretPassword
ldap_tls_cacertdir = /etc/openldap/cacerts

My krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = MYDOMAIN.FR
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

[realms]
MYDOMAIN.FR = {
kdc = XXX.XXX.XXX.XXX
admin_server = XXX.XXX.XXX.XXX
}

[domain_realm]
.mydomain.fr = MYDOMAIN.FR
mydomain.fr = MYDOMAIN.FR => Hello all.
I'm trying to setup a ldap against AD authentication. I've installed SSSD 1.12.4
OS: Red Hat Enterprise Linux Server release 6.2 (Santiago)
In the logs, my search brings back the user but the final result fails in not found.

for testing I use 'id WXYZ123'

A ldapsearch works fine.

I've tried to set ldap_id_mapping = false to true but the request is completed with a ((null=*)) AND condition => so it fails each time

I've already spent 5 days and getting crazy. I've googled a lot but don't found any answer, except the https://fedorahosted.org/sssd/ticket/2666 ticket.

A great thanks to any help you could bring to me
Happy new year!

PS: I'm french and didn't practice english writing for a long time, sorry :) )
{{{
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_print_server] (0x2000): Searching XXX.XXX.XXX.XXX
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=WXYZ123)(objectclass=user)(sAMAccountName=)(&(objectSid=)(!(objectSid=0))))][OU=RessLocales,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr].
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSid]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectGUID]
[...]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sshPublicKey]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 3
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_id_op_connect_done] (0x4000): caching successful connection after 1 notifies
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [be_run_unconditional_online_cb] (0x4000): List of unconditional online callbacks is empty, nothing to do.
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[0x10e5d90], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[0x10e5d90], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=FERON Matthieu,OU=Utilisateurs,OU=MainOU,OU=RessLocales,DC=corp,DC=log,DC=intra,DC=mydomain,DC=fr].
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [cn]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [memberOf]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectGUID]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [userAccountControl]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [accountExpires]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimeStamp]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[0x10e5d90], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results.
}}}
Great, I found myself!
{{{
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_search_user_process] (0x4000): Retrieved total 1 users
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [ldb] (0x4000): start ldb transaction (nesting: 0)
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_save_user] (0x0400): Save user
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_attrs_get_sid_str] (0x1000): No [objectSID] attribute. [0][Success]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_save_user] (0x4000): objectSID: not available for user
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_primary_name] (0x0400): Processing object XORC529
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_save_user] (0x0400): Processing user XORC529
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [ldb] (0x4000): commit ldb transaction (nesting: 0)
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_get_users_done] (0x4000): Saving 1 Users - Done
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_id_op_done] (0x4000): releasing operation connection
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: sh[0x10d8800], connected[1], ops[(nil)], ldap[0x10d51d0]
(Mon Jan 18 10:42:07 2016) [sssd[be[laposte.fr]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
}}}
Whu ??
{{{
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_dispatch] (0x4000): dbus conn: 0x10c2670
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_dispatch] (0x4000): Dispatching.
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_message_handler] (0x4000): Received SBUS method [ping]
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit
(Mon Jan 18 10:42:13 2016) [sssd[be[laposte.fr]]] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [ping]
}}}

Here is my sssd.conf
{{{
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = mydomain.fr

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3

[pam]
reconnection_retries = 3

My krb5.conf
{{{
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = MYDOMAIN.FR
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

[realms]
MYDOMAIN.FR = {
kdc = XXX.XXX.XXX.XXX
admin_server = XXX.XXX.XXX.XXX
}

[domain_realm]
.mydomain.fr = MYDOMAIN.FR
mydomain.fr = MYDOMAIN.FR
}}}

lslebodn commented Jan 18, 2016

Could you provide full sssd log file and not just parts?

mferon commented Jan 18, 2016

My sssd log file
sssd_mydomain.fr.log

mferon commented Jan 18, 2016

Here it is

mferon commented Jan 18, 2016

Replying to [comment:2 lslebodn]:

Could you provide full sssd log file and not just parts?
Here it is. Sorry for the double post, i'm not yet used to this tool

lslebodn commented Jan 18, 2016

The log file only show use lookup which was successful.

156 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_get_primary_name] (0x0400): Processing object WXYZ123
157 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_save_user] (0x0400): Processing user WXYZ123
158 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [ldb] (0x4000): commit ldb transaction (nesting: 0)
159 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_get_users_done] (0x4000): Saving 1 Users - Done
160 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_id_op_done] (0x4000): releasing operation connection
161 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success

I cannot see any attempt for authentication in log files. Could you provide new log files with problematic authentication?

cc: => lslebodn

mferon commented Jan 19, 2016

Replying to [comment:5 lslebodn]:

The log file only show use lookup which was successful.
{{{
156 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_get_primary_name] (0x0400): Processing object WXYZ123
157 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_save_user] (0x0400): Processing user WXYZ123
158 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [ldb] (0x4000): commit ldb transaction (nesting: 0)
159 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_get_users_done] (0x4000): Saving 1 Users - Done
160 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_id_op_done] (0x4000): releasing operation connection
161 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
}}}

I cannot see any attempt for authentication in log files. Could you provide new log files with problematic authentication?

I'm not sure to understand but it ends saying Trace: ldap_result found nothing! line 163.
Do you mean that the sssd process is ok and that the problem is in another part of the process ?

Thanks for your help

mferon commented Jan 19, 2016

Replying to [comment:5 lslebodn]:

The log file only show use lookup which was successful.
{{{
156 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_get_primary_name] (0x0400): Processing object WXYZ123
157 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_save_user] (0x0400): Processing user WXYZ123
158 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [ldb] (0x4000): commit ldb transaction (nesting: 0)
159 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_get_users_done] (0x4000): Saving 1 Users - Done
160 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [sdap_id_op_done] (0x4000): releasing operation connection
161 (Mon Jan 18 10:42:07 2016) [sssd[be[mydomain.fr]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
}}}

I cannot see any attempt for authentication in log files. Could you provide new log files with problematic authentication?

here are log files, as you coul'd see, there is no activity except sssd:
-rw------- 1 root root 0 Jan 19 09:45 krb5_child.log
-rw------- 1 root root 0 Jan 19 09:45 ldap_child.log
-rw------- 1 root root 141404 Jan 19 10:03 sssd_mydomain.fr.log
-rw------- 1 root root 0 Jan 19 09:45 sssd.log
-rw------- 1 root root 0 Jan 19 09:45 sssd_nss.log
-rw------- 1 root root 0 Jan 19 09:45 sssd_pam.log

jhrozek commented Jan 19, 2016

I'm pretty sure this:

ldap_user_uid_number = objectSid

will not work. If you're trying to use the POSIX attributes (as indicated with ldap_id_mapping = false) then you need to map ldap_user_uid_number to a valid integer..

lslebodn commented Jan 19, 2016

I totally missed mapping of attributes. the attribute for gid number is not correct as well.

ldap_user_gid_number = objectGUID

The best would be if you could follow wiki how to configure sssd with Active Directory.
https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate%20with%20a%20Windows%202008%20Domain%20Server

mferon commented Jan 20, 2016

I've managed to authentify my user by changing id_mapping to true and schema to ad.

@lslebodn: I can't modify anything on the AD

Thanks all

lslebodn commented Jan 20, 2016

Thank you for confirmation.
I will close the ticket as works for me.

owner: somebody => lslebodn
status: new => assigned

lslebodn commented Jan 20, 2016

Fields changed

resolution: => worksforme
status: assigned => closed

Metadata Update from @mferon:
- Issue assigned to lslebodn
- Issue set to the milestone: NEEDS_TRIAGE

Feb 24, 2017

pbrezina commented May 2, 2020

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3971

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata

Assignee

lslebodn

Tags

None

Blocking

None

Depending on

None

Priority

Low

testsupdated

patch

design_review

review

sensitive

mark

type

defect

component

SSSD

version

1.12.4

rhbz

None

SSSD / sssd

#2930 User found in AD but authentication fails Closed: Invalid Opened Jan 18, 2016 by mferon.

Metadata

#2930 User found in AD but authentication fails

Closed: Invalid Opened Jan 18, 2016 by mferon.