SSSD / sssd

#3664 LOGS: Improve debugging in case the PAM service is not mapped to any GPO rule
Closed: Fixed Opened by mzidek.

Closed: Fixed
Reopen Issue

The logs should give better hints on what went wrong incase the user is denied access due to PAM service not being mapped to any GPO rule.

Here is feedback from user:

The issue is with the logging. The man page was fairly clear once I figured out what to look for.

The standard error message gives absolutely no hint as to why access is denied:

Mar  8 15:13:51 ubuntu1604 pamtester: pam_sss(thinlinc:account): Access denied for user ossman: 6 (Permission denied)

The debug message at least says that it has to do with GPOs and services, but no clue beyond that:

(Thu Mar  8 15:13:51 2018) [sssd[be[lab.lkpg.cendio.se]]] [ad_gpo_access_send] (0x0400): service thinlinc maps to Denied

I would have preferred if the standard log message informed me that access was denied because the service thinlinc is not mapped to any GPO rule.

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.2

Metadata Update from @jhrozek:
- Issue assigned to mzidek
- Issue tagged with: PR

PR: https://github.com/SSSD/sssd/pull/593
  • master:
  • f3f1bd4acc6d16d685d109d26cb654db9d9c582e
  • 39d37f6daeaa5f0b12de3d36c43300aaeabf1d5c

Metadata Update from @jhrozek:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4684

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata

PR

None
None
High
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.