March 2019 - FreeIPA-users - Fedora mailing-lists

Re: freeIPA Host certs
by Florence Blanc-Renaud 19 Mar '19

19 Mar '19

On 3/18/19 7:50 PM, Azim Siddiqui wrote: > Hi Florence, > > Thanks for your reply. > I am referring to the applications. For example, we have > Apache,haproxy,jenkins,git which uses certs signed by IPA. And now when > I am browsing these applications urls. It is showing, this site is not > secured. > And originally, This cert were created by a system admin, who is not > working with us now. So its getting hard for me to figure out, how can I > create or renew the certs. > > And I don't see any files ssl.conf or nss.conf in the server. > The output for getcert list command shows this :- > getcert list > Number of certificates and requests being tracked: 0. > > > I just want to create a crt and key file signed by IPA. So that I can > use it for the browsers. Hi, please keep the users mailing list in cc, so that everyone can get involved/see the resolution. It is difficult to provide advice with so few information. Can you start by checking which certificates were already issued by FreeIPA, and we'll see if they are expired? $ kinit admin $ ipa cert-find With the full output and based on the subject you'll be able to identify the host or service certs that you are using for your applications. For each of these certs, run $ kinit admin $ ipa cert-show <serial number> and the output will show if the cert is expired (check the Not After field). For an expired cert, you will be able to renew the cert if you still have the private key. The private key location can be found by checking the configuration of your applications. For instance apache on rhel or fedora stores its config in /etc/httpd/conf/httpd.conf, which by default loads the modules in conf.modules.d/*.conf and the config files in conf.d/*.conf. flo > > Thanks, > Azeem > > > On Mon, 18 Mar 2019 at 05:30, Florence Blanc-Renaud <flo(a)redhat.com > <mailto:flo@redhat.com>> wrote: > > On 3/15/19 8:16 PM, Azim Siddiqui wrote: > > Hi Florence, > > > > Hope you are doing good. I tried the way you said. But still, it is > > showing certificate is expired. > > > > Let me be more clear about it. > > > > We have apache running with an expired certificate which is > signed by > > FreeIPA. Now I want to renew or create a new certificate. So can you > > please tell me how can I renew or create a new certificate signed by > > Freeipa. > > As whenever I am going to the Apache URL from the browser, it is > showing > > site is not secured. > > > > Thanks & Regards, > > Azeem > > > Hi, > > (re-adding freeipa-users in CC). > Can you first confirm that you are referring to a cert for the apache > server *not running on one of the FreeIPA masters*? > > Then please explain how you originally obtained the certificate. Also > include the following information: > - relevant apache configuration (if using mod_ssl, then > /etc/httpd/conf.d/ssl.conf or if using mod_nss, > /etc/httpd/conf.d/nss.conf). > - output of getcert list on the host running apache > > flo > > > On Wed, 19 Dec 2018 at 14:04, Florence Blanc-Renaud > <flo(a)redhat.com <mailto:flo@redhat.com> > > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> wrote: > > > > On 12/13/18 4:04 PM, Azim Siddiqui via FreeIPA-users wrote: > > > Hello, > > > > > > Hope you are doing good. I have a question regarding > freeIPA host > > > certificates. > > > We are using FreeIPA as our LDAP. We have some > certificates for > > hosts ex > > > :- http/uat.com <http://uat.com> <http://uat.com> > <http://uat.com>. > > > And we deploying the certs in Haproxy in PEM format. > > > But the certificates for this host has been expired. > > > Can you please let me know in detail how to renew my expired > > > certificates for the hosts. Please provide me the commands > and steps. > > > > > Hi, > > > > from your description I understand that you are referring to > > certificates delivered by IPA CA for one of the IPA-enrolled > hosts, but > > not the master's Server-Cert used for IPA Web GUI. > > > > In this case, how did you obtain the certificate? If you used > a method > > similar to what is described in this wiki [1], the certificate > > should be > > monitored by certmonger and automatically renewed. > > > > If you followed instead this wiki [2], the certificate is not > > tracked by > > certmonger and needs to be manually renewed. You need to do the > > following, assuming that the cert is in a NSS database $NSSDB > on the > > IPA > > client: > > - find the key nickname > > # certutil -K -d $NSSDB > > certutil: Checking token "NSS Certificate DB" in slot "NSS > User Private > > Key and Certificate Services" > > Enter Password or Pin for "NSS Certificate DB": > > < 0> rsa 7c0646606b33ab683ee4d1790719ebc4154db0f6 NSS > > Certificate > > DB:Server-Cert > > (note the key nickname for the next command) > > > > - create a new certificate request that will re-use the > existing key > > (replace DOMAIN.COM <http://DOMAIN.COM> <http://DOMAIN.COM> > with your IPA domain, in > > uppercase): > > # certutil -R -d $NSSDB -k "NSS Certificate DB:Server-Cert" -s > > cn=`hostname,O=DOMAIN.COM <http://DOMAIN.COM> > <http://DOMAIN.COM>" -a -o /tmp/cert.csr > > Enter Password or Pin for "NSS Certificate DB": > > > > - request a certificate using the new certificate request > > # kinit admin > > # ipa cert-request --principal=HTTP/`hostname` /tmp/web.csr > > (the output will display a Serial Number that needs to be > noted for the > > next command) > > > > - remove the previous cert from the NSS database: > > # certutil -D -d $NSSDB -n Server-Cert > > > > - export the certificate to a file, then import the > certificate in the > > NSS database: > > # ipa cert-show $SERIAL_NUMBER --out=/tmp/server.crt > > # certutil -A -d $NSSDB -n Server-Cert -t u,u,u -i > /tmp/server.crt > > > > HTH, > > flo > > > > [1] > > > https://www.freeipa.org/page/PKI#Automated_certificate_requests_with_Certmo… > > [2] https://www.freeipa.org/page/PKI#Manual_certificate_requests > > > > > FreeIPA, version: 4.2.0 > > > > > > Thanks & Regards, > > > Azeem > > > > > > > > > _______________________________________________ > > > FreeIPA-users mailing list -- > > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > To unsubscribe send an email to > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > Fedora Code of Conduct: > https://getfedora.org/code-of-conduct.html > > > List Guidelines: > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > List Archives: > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > >

1 0

ipa-replica-manage --force replica.server fails
by Ralph Crongeyer 18 Mar '19

18 Mar '19

Hi List, I have a master server that had a replica installed. The replica has been uninstalled. When I try to run "ipa-replica-manage del --force replica.server" it fails with: invalid 'PKINIT enabled server': all masters must have IPA master role enabled How can I delete this replica? Thanks, Ralph

7 22

Re: ipa-replica-manage --force replica.server fails
by Dmitry Perets 18 Mar '19

18 Mar '19

Hi, I have the same issue right now... I had two working replicas, and I tried to add the third one. But due to some issues with ansible playbook, the installation of that third replica failed in the middle (I believe ansible lost SSH connection somewhere in the middle). That obviously left the new replica in kinda undefined state, which is not my issue. My issue is that it affected WebUI of both other two replicas. Exactly as the others report, I can no longer login to the WebUI. It says "invalid 'PKINIT enabled server': all masters must have IPA master role enabled" and then throws an exception: TypeError: Cannot read property 'ipapwdexpadvnotify' of undefined at Object.y.update_password_expiration (https://rhel-ipa-replica.ams.ims.telekom.de/ipa/ui/js/freeipa/app.js?40604:…) at Object.start_runtime (https://rhel-ipa-replica.ams.ims.telekom.de/ipa/ui/js/freeipa/app.js?40604:…) at Object.<anonymous> (https://rhel-ipa-replica.ams.ims.telekom.de/ipa/ui/js/freeipa/app.js?40604:…) at https://rhel-ipa-replica.ams.ims.telekom.de/ipa/ui/js/freeipa/app.js?40604:… at Object.forEach (https://rhel-ipa-replica.ams.ims.telekom.de/ipa/ui/js/dojo/dojo.js?v=40604:…) at Object._run_phase (https://rhel-ipa-replica.ams.ims.telekom.de/ipa/ui/js/freeipa/app.js?40604:…) at Object.next_phase (https://rhel-ipa-replica.ams.ims.telekom.de/ipa/ui/js/freeipa/app.js?40604:…) at Object.<anonymous> (https://rhel-ipa-replica.ams.ims.telekom.de/ipa/ui/js/freeipa/app.js?40604:…) at c (https://rhel-ipa-replica.ams.ims.telekom.de/ipa/ui/js/dojo/dojo.js?v=40604:…) at e.extend.then.then.t.then (https://rhel-ipa-replica.ams.ims.telekom.de/ipa/ui/js/dojo/dojo.js?v=40604:…) All the commands offered in this thread give me the same error so far: "invalid 'PKINIT enabled server': all masters must have IPA master role enabled" Fortunately, it seems that the domain services keep working fine, users can login etc. But WebUI is dead, and the failed replica is stuck in the list of ipa-replica-manage... Sounds like a bug...? -- Regards, Dmitry Perets. "The more one knows, the less opinions he shares" -- Wilhelm Schwebel

2 2

replace ipa-server and relink clients on same realm
by Rob van Halteren 18 Mar '19

18 Mar '19

I had to replace the IPA-server due to loss of CA Original setup was that all clients were connected to a replica-server v3.0 on centos 6 that hosted the domain and realm OURDOMAIN.EXAMPLE I configured a new IPA-master v4.6.4 on centos 7 with the same domain,realm, and id-range and reconnected all clients to the new master. I used ipa-client-install --uninstall , cleared /var/lib/sss/db/*, and ran ipa-client-install All clients now login from the new ipa-master. All woks fine as long as I leave the old replica-server online. As soon as I turn it off, my clients start to suffer problems after a couple of hours or next day that cause several applications to stall when opening. Eg Firefox browser will not start any more. DNS is online and resolves requests When I then start the old replica again all function restore almost immediately as it comes online. Does someone has any idea what could be happening ?

2 7

Block change others password
by Mateusz O 18 Mar '19

18 Mar '19

Hello, I want to gave users possibility to change their password, but when I log in using user from ipausers group I can view others account and reset their passwords. How to block it? I wan to set everything to block a normal user from group ipausers view others account (he's able to see only his account) and reset only his password. Best regards? Mateusz

2 3

Re: freeIPA Host certs
by Florence Blanc-Renaud 18 Mar '19

18 Mar '19

On 3/15/19 8:16 PM, Azim Siddiqui wrote: > Hi Florence, > > Hope you are doing good. I tried the way you said. But still, it is > showing certificate is expired. > > Let me be more clear about it. > > We have apache running with an expired certificate which is signed by > FreeIPA. Now I want to renew or create a new certificate. So can you > please tell me how can I renew or create a new certificate signed by > Freeipa. > As whenever I am going to the Apache URL from the browser, it is showing > site is not secured. > > Thanks & Regards, > Azeem > Hi, (re-adding freeipa-users in CC). Can you first confirm that you are referring to a cert for the apache server *not running on one of the FreeIPA masters*? Then please explain how you originally obtained the certificate. Also include the following information: - relevant apache configuration (if using mod_ssl, then /etc/httpd/conf.d/ssl.conf or if using mod_nss, /etc/httpd/conf.d/nss.conf). - output of getcert list on the host running apache flo > On Wed, 19 Dec 2018 at 14:04, Florence Blanc-Renaud <flo(a)redhat.com > <mailto:flo@redhat.com>> wrote: > > On 12/13/18 4:04 PM, Azim Siddiqui via FreeIPA-users wrote: > > Hello, > > > > Hope you are doing good. I have a question regarding freeIPA host > > certificates. > > We are using FreeIPA as our LDAP. We have some certificates for > hosts ex > > :- http/uat.com <http://uat.com> <http://uat.com>. > > And we deploying the certs in Haproxy in PEM format. > > But the certificates for this host has been expired. > > Can you please let me know in detail how to renew my expired > > certificates for the hosts. Please provide me the commands and steps. > > > Hi, > > from your description I understand that you are referring to > certificates delivered by IPA CA for one of the IPA-enrolled hosts, but > not the master's Server-Cert used for IPA Web GUI. > > In this case, how did you obtain the certificate? If you used a method > similar to what is described in this wiki [1], the certificate > should be > monitored by certmonger and automatically renewed. > > If you followed instead this wiki [2], the certificate is not > tracked by > certmonger and needs to be manually renewed. You need to do the > following, assuming that the cert is in a NSS database $NSSDB on the > IPA > client: > - find the key nickname > # certutil -K -d $NSSDB > certutil: Checking token "NSS Certificate DB" in slot "NSS User Private > Key and Certificate Services" > Enter Password or Pin for "NSS Certificate DB": > < 0> rsa 7c0646606b33ab683ee4d1790719ebc4154db0f6 NSS > Certificate > DB:Server-Cert > (note the key nickname for the next command) > > - create a new certificate request that will re-use the existing key > (replace DOMAIN.COM <http://DOMAIN.COM> with your IPA domain, in > uppercase): > # certutil -R -d $NSSDB -k "NSS Certificate DB:Server-Cert" -s > cn=`hostname,O=DOMAIN.COM <http://DOMAIN.COM>" -a -o /tmp/cert.csr > Enter Password or Pin for "NSS Certificate DB": > > - request a certificate using the new certificate request > # kinit admin > # ipa cert-request --principal=HTTP/`hostname` /tmp/web.csr > (the output will display a Serial Number that needs to be noted for the > next command) > > - remove the previous cert from the NSS database: > # certutil -D -d $NSSDB -n Server-Cert > > - export the certificate to a file, then import the certificate in the > NSS database: > # ipa cert-show $SERIAL_NUMBER --out=/tmp/server.crt > # certutil -A -d $NSSDB -n Server-Cert -t u,u,u -i /tmp/server.crt > > HTH, > flo > > [1] > https://www.freeipa.org/page/PKI#Automated_certificate_requests_with_Certmo… > [2] https://www.freeipa.org/page/PKI#Manual_certificate_requests > > > FreeIPA, version: 4.2.0 > > > > Thanks & Regards, > > Azeem > > > > > > _______________________________________________ > > FreeIPA-users mailing list -- > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > >

1 0

Ad user password authentication doesn't work
by Patrick Irish 18 Mar '19

18 Mar '19

I've been fighting with this for 2 months. I've rebuilt both the ad and ip server twice. Currently ipa and ad only contain a single unique user. AD and ipa are on separate dns domains (ad.domain.com and int.domain.com respectively). AD domain has windows pc joined to it. IPA server has linux server joined to it. Any help is greatly appreciated. AD server Server: dc0.ad.domain.com Domain: ad.domain.com IP: 10.10.60.81 IPA server Server: identity.int.domain.com domain int.domain.com IP: 10.10.60.61 What works on ipa server: id aduser getent passwd aduser kinit aduser(a)ad.domain.com what doesn't work ssh 'aduse(a)ad.domain.com'@ipaserver Password: Password: Password: [localuser@ipaserver] su - aduser(a)ad.domain.com Password: su: Authentication failure logs: ldap_child.log (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [main] (0x0400): ldap_child started. (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [main] (0x2000): context initialized (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [unpack_buffer] (0x1000): total buffer size: 70 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [unpack_buffer] (0x1000): realm_str size: 16 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [unpack_buffer] (0x1000): got realm_str: INT.DOMAIN.COM (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [unpack_buffer] (0x1000): princ_str size: 30 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [unpack_buffer] (0x1000): got princ_str: host/identity.int.domain.com (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [unpack_buffer] (0x1000): keytab_name size: 0 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [unpack_buffer] (0x1000): lifetime: 86400 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [unpack_buffer] (0x0200): Will run as [0][0]. (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [privileged_krb5_setup] (0x2000): Kerberos context initialized (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [main] (0x2000): Kerberos context initialized (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [become_user] (0x0200): Trying to become user [0][0]. (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [become_user] (0x0200): Already user [0]. (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [main] (0x2000): Running as [0][0]. (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [main] (0x2000): getting TGT sync (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [ldap_child_get_tgt_sync] (0x2000): got realm_name: [INT.DOMAIN.COM] (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [host/identity.int.domain.com(a)INT.DOMAIN.COM] (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [MEMORY:/etc/krb5.keytab] (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [ldap_child_get_tgt_sync] (0x0100): Will canonicalize principals (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14735: Getting initial credentials for host/identity.int.domain.com(a)INT.DOMAIN.COM (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14736: Looked up etypes in keytab: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14738: Sending unauthenticated request (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14739: Sending request (219 bytes) to INT.DOMAIN.COM (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14740: Initiating TCP connection to stream 10.10.60.61:88 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14741: ending TCP request to stream 10.10.60.61:88 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14742: Received answer (593 bytes) from stream 10.10.60.61:88 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14743: Terminating TCP connection to stream 10.10.60.61:88 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14744: Response was from master KDC (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14745: Received error from KDC: -1765328359/Additional pre-authentication required (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14748: Preauthenticating using KDC method data (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14749: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-PK-AS-REQ_OLD (14), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133) (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14750: Selected etype info: etype aes256-cts, salt "INT.DOMAIN.COMhostidentity.int.domain.com", params "" (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14751: Received cookie: MIT1\x00\x00\x00\x01\x86\x9a\x8e>yI7\xe0\x9a\xa5xym\xa2,F{`d\xe7 N \x12\xef\xf1\x09)\x09:y\xc7J\xc8\xcd0U\x01\xacs\xbc\x02\x9a\xae\xfc\xe0\xa6\x0c\xe0\x96\x04e\xde\xc5?\xa0:U\xb8\xcdm\xbe\x0e\xf5\x9eW`\xa1\xd0\xcd\xed\xcd\xd0\x1a\xbb\xcfz\xe3\x91T\x03\xba\x05J\x8cz\xe3\x90\xe6\x8f\xa1\xf23\xea\xf8\x97\x12\xb7}\x15.\xd06$\x1aZ\xe7\xd5\xfd\x09D\xb2n\xafV\xb3\xc9\xab\xf8\xe7\xd3h-\xac?\x87\x15>\xd3G (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14752: PKINIT client has no configured identity; giving up (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14753: Preauth module pkinit (147) (info) returned: 0/Success (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14754: PKINIT client received freshness token from KDC (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14755: Preauth module pkinit (150) (info) returned: 0/Success (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14756: PKINIT client has no configured identity; giving up (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14757: Preauth module pkinit (16) (real) returned: 22/Invalid argument (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14758: PKINIT client ignoring draft 9 offer from RFC 4556 KDC (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14759: Preauth module pkinit (15) (real) returned: -1765328360/Preauthentication failed (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14760: PKINIT client ignoring draft 9 offer from RFC 4556 KDC (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14761: Preauth module pkinit (14) (real) returned: -1765328360/Preauthentication failed (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14762: PAKE challenge received with group 1, pubkey 400BEA93DC1F29293028E9CBDAB7FE7649318A0DBF7AF492C319ADA76A4B59F4 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14763: Retrieving host/identity.int.domain.com(a)INT.DOMAIN.COM from MEMORY:/etc/krb5.keytab (vno 0, enctype aes256-cts) with result: 0/Success (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14764: SPAKE key generated with pubkey 9BE6AA79E0B53D1B97641EB9FA6A27D0EE7C0387B05032B85920E190546464A6 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14765: SPAKE algorithm result: A501375464DD840A9E83F2038D18FE4AE664D3E8676983319E38E4D443476779 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14766: SPAKE final transcript hash: 27EB757B9F468B2A657293FB37623F3E7D47179A7A11B85D898D95011449DA2C (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14767: Sending SPAKE response (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14768: Preauth module spake (151) (real) returned: 0/Success (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14770: Sending request (478 bytes) to INT.DOMAIN.COM (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14771: Initiating TCP connection to stream 10.10.60.61:88 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14772: Sending TCP request to stream 10.10.60.61:88 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14773: Received answer (1496 bytes) from stream 10.10.60.61:88 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14774: Terminating TCP connection to stream 10.10.60.61:88 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14775: Response was from master KDC (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14776: Processing preauth types: PA-ETYPE-INFO2 (19) (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14777: Selected etype info: etype aes256-cts, salt "INT.DOMAIN.COMhostidentity.int.domain.com", params "" (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14778: Produced preauth for next request: (empty) (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14779: AS key determined by preauth: aes256-cts/5039 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14780: Decrypted AS reply; session key is: aes256-cts/4179 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14781: FAST negotiation: available (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [ldap_child_get_tgt_sync] (0x2000): credentials initialized (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [ldap_child_get_tgt_sync] (0x2000): keytab ccname: [FILE:/var/lib/sss/db/ccache_INT.DOMAIN.COM_YzeV0z] (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14782: Initializing FILE:/var/lib/sss/db/ccache_INT.DOMAIN.COM_YzeV0z with default princ host/identity.int.domain.com(a)INT.DOMAIN.COM (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [sss_child_krb5_trace_cb] (0x4000): [2798] 1550983820.14783: Storing host/identity.int.domain.com(a)INT.DOMAIN.COM -> krbtgt/INT.DOMAIN.COM(a)INT.DOMAIN.COM in FILE:/var/lib/sss/db/ccache_INT.DOMAIN.COM_YzeV0z (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [ldap_child_get_tgt_sync] (0x2000): credentials stored (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [ldap_child_get_tgt_sync] (0x2000): Got KDC time offset (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [ldap_child_get_tgt_sync] (0x2000): Renaming [/var/lib/sss/db/ccache_INT.DOMAIN.COM_YzeV0z] to [/var/lib/sss/db/ccache_INT.DOMAIN.COM] (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/db/ccache_INT.DOMAIN.COM_YzeV0z] (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/db/ccache_INT.DOMAIN.COM_YzeV0z] (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [prepare_response] (0x0400): Building response for result [0] (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [pack_buffer] (0x2000): response size: 64 (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [pack_buffer] (0x1000): result [0] krberr [0] msgsize [44] msg [FILE:/var/lib/sss/db/ccache_INT.DOMAIN.COM] (Sat Feb 23 23:50:20 2019) [[sssd[ldap_child[2798]]]] [main] (0x0400): ldap_child completed successfully (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [main] (0x0400): ldap_child started. (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [main] (0x2000): context initialized (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unpack_buffer] (0x1000): total buffer size: 94 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unpack_buffer] (0x1000): realm_str size: 15 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unpack_buffer] (0x1000): got realm_str: AD.DOMAIN.COM (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unpack_buffer] (0x1000): princ_str size: 12 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unpack_buffer] (0x1000): got princ_str: INTDOMAIN$ (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unpack_buffer] (0x1000): keytab_name size: 43 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unpack_buffer] (0x1000): got keytab_name: /var/lib/sss/keytabs/ad.domain.com.keytab (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unpack_buffer] (0x1000): lifetime: 86400 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unpack_buffer] (0x0200): Will run as [0][0]. (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [privileged_krb5_setup] (0x2000): Kerberos context initialized (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [main] (0x2000): Kerberos context initialized (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [become_user] (0x0200): Trying to become user [0][0]. (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [become_user] (0x0200): Already user [0]. (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [main] (0x2000): Running as [0][0]. (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [main] (0x2000): getting TGT sync (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [ldap_child_get_tgt_sync] (0x2000): got realm_name: [AD.DOMAIN.COM] (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [INTDOMAIN$(a)AD.DOMAIN.COM] (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [MEMORY:/var/lib/sss/keytabs/ad.domain.com.keytab] (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234657: Getting initial credentials for INTDOMAIN$(a)AD.DOMAIN.COM (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234658: Looked up etypes in keytab: aes256-cts, aes128-cts, rc4-hmac (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234660: Sending unauthenticated request (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234661: Sending request (198 bytes) to AD.DOMAIN.COM (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234662: Initiating TCP connection to stream 10.10.60.81:88 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234663: Sending TCP request to stream 10.10.60.81:88 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234664: Received answer (206 bytes) from stream 10.10.60.81:88 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234665: Terminating TCP connection to stream 10.10.60.81:88 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234666: Response was from master KDC (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234667: Received error from KDC: -1765328359/Additional pre-authentication required (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234670: Preauthenticating using KDC method data (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234671: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234672: Selected etype info: etype aes256-cts, salt "AD.DOMAIN.COMkrbtgtINTDOMAIN", params "" (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234673: PKINIT client has no configured identity; giving up (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234674: PKINIT client has no configured identity; giving up (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234675: Preauth module pkinit (16) (real) returned: 22/Invalid argument (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234676: PKINIT client ignoring draft 9 offer from RFC 4556 KDC (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234677: Preauth module pkinit (15) (real) returned: -1765328360/Preauthentication failed (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234678: Retrieving INTDOMAIN$(a)AD.DOMAIN.COM from MEMORY:/var/lib/sss/keytabs/ad.domain.com.keytab (vno 0, enctype aes256-cts) with result: 0/Success (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234679: AS key obtained for encrypted timestamp: aes256-cts/18D5 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234681: Encrypted timestamp (for 1550983885.896873): plain 301AA011180F32303139303232343034353132355AA10502030DAF69, encrypted F264C965CF31F9501C9942AFEBF282493E712F282BBB6B47C1F7417317F6334B814F2E7CAB6FE13117A3BC3B8F8E91F5D0576E7957684AB3 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234682: Preauth module encrypted_timestamp (2) (real) returned: 0/Success (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234683: Produced preauth for next request: PA-ENC-TIMESTAMP (2) (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234684: Sending request (278 bytes) to AD.DOMAIN.COM (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234685: Initiating TCP connection to stream 10.10.60.81:88 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234686: Sending TCP request to stream 10.10.60.81:88 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234685: Initiating TCP connection to stream 10.10.60.81:88 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234686: Sending TCP request to stream 10.10.60.81:88 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234687: Received answer (1585 bytes) from stream 10.10.60.81:88 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234688: Terminating TCP connection to stream 10.10.60.81:88 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234689: Response was from master KDC (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234690: Processing preauth types: PA-ETYPE-INFO2 (19) (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234691: Selected etype info: etype aes256-cts, salt "AD.DOMAIN.COMkrbtgtINTDOMAIN", params "" (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234692: Produced preauth for next request: (empty) (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234693: AS key determined by preauth: aes256-cts/18D5 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234694: Decrypted AS reply; session key is: aes256-cts/AE91 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234695: FAST negotiation: unavailable (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [ldap_child_get_tgt_sync] (0x2000): credentials initialized (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [ldap_child_get_tgt_sync] (0x2000): keytab ccname: [FILE:/var/lib/sss/db/ccache_AD.DOMAIN.COM_ZuI79F] (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234696: Initializing FILE:/var/lib/sss/db/ccache_AD.DOMAIN.COM_ZuI79F with default princ INTDOMAIN$(a)AD.DOMAIN.COM (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [sss_child_krb5_trace_cb] (0x4000): [2802] 1550983884.234697: Storing INTDOMAIN$(a)AD.DOMAIN.COM -> krbtgt/AD.DOMAIN.COM(a)AD.DOMAIN.COM in FILE:/var/lib/sss/db/ccache_AD.DOMAIN.COM_ZuI79F (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [ldap_child_get_tgt_sync] (0x2000): credentials stored (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [ldap_child_get_tgt_sync] (0x2000): Got KDC time offset (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [ldap_child_get_tgt_sync] (0x2000): Renaming [/var/lib/sss/db/ccache_AD.DOMAIN.COM_ZuI79F] to [/var/lib/sss/db/ccache_AD.DOMAIN.COM] (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/db/ccache_AD.DOMAIN.COM_ZuI79F] (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/db/ccache_AD.DOMAIN.COM_ZuI79F] (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [prepare_response] (0x0400): Building response for result [0] (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [pack_buffer] (0x2000): response size: 63 (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [pack_buffer] (0x1000): result [0] krberr [0] msgsize [43] msg [FILE:/var/lib/sss/db/ccache_AD.DOMAIN.COM] (Sat Feb 23 23:51:24 2019) [[sssd[ldap_child[2802]]]] [main] (0x0400): ldap_child completed successfully krb5_child.log: empty during log in attempts sssd_int.domain.com.log (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_done] (0x4000): releasing operation connection (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_done] (0x0400): DP Request [Subdomains #15]: Request handler finished [0]: Success (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [_dp_req_recv] (0x0400): DP Request [Subdomains #15]: Receiving request data. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_reply_list_success] (0x0400): DP Request [Subdomains #15]: Finished. Success. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_reply_std] (0x1000): DP Request [Subdomains #15]: Returning [Success]: 0,0,Success (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_table_value_destructor] (0x0400): Removing [8:8:0000:ad.domain.com'] from reply table (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_destructor] (0x0400): DP Request [Subdomains #15]: Request removed. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c16110], connected[1], ops[(nil)], ldap[0x561795c1df90] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sbus_dispatch] (0x4000): dbus conn: 0x561795bad8d0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sbus_dispatch] (0x4000): Dispatching. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name='aduser(a)ad.domain.com'] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_attach_req] (0x0400): DP Request [Account #16]: New request. Flags [0x0001]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain int.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain int.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [cn=accounts,dc=int,dc=domain,dc=com] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_print_server] (0x2000): Searching 10.10.60.61:389 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(|(krbPrincipalName='aduser(a)ad.domain.com')(mail='aduser(a)ad.domain.com')(krbPrincipalName='aduser\\(a)ad.domain.com'@INT.domain.COM))(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][cn=accounts,dc=int,dc=domain,dc=com]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [homeDirectory] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPrincipalName] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaUniqueID] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaNTSecurityIdentifier] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [entryUSN] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaSshPubKey] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaUserAuthType] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userCertificate;binary] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [mail] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 14 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_add] (0x2000): New operation 14 timeout 6 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c16110], connected[1], ops[0x561795c0d3a0], ldap[0x561795c1df90] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_destructor] (0x2000): Operation 14 finished (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [cn=trusts,dc=int,dc=domain,dc=com] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_print_server] (0x2000): Searching 10.10.60.61:389 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(&(|(krbPrincipalName='aduser(a)ad.domain.com')(mail='aduser(a)ad.domain.com')(krbPrincipalName='aduser\\(a)ad.domain.com'@INT.domain.COM))(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))(objectClass=ipaIDObject))][cn=trusts,dc=int,dc=domain,dc=com]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [homeDirectory] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPrincipalName] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaUniqueID] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaNTSecurityIdentifier] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [entryUSN] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaSshPubKey] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaUserAuthType] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userCertificate;binary] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [mail] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 15 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_add] (0x2000): New operation 15 timeout 6 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c16110], connected[1], ops[0x561795c0d3a0], ldap[0x561795c1df90] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c16110], connected[1], ops[0x561795c0d3a0], ldap[0x561795c1df90] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_destructor] (0x2000): Operation 15 finished (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_search_user_process] (0x2000): Retrieved total 0 users (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_done] (0x4000): releasing operation connection (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x561795c16e00 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x561795c16cf0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Running timer event 0x561795c16e00 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Destroying timer event 0x561795c16cf0 "ltdb_timeout" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Ending timer event 0x561795c16e00 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sysdb_search_by_name] (0x0400): No such entry (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sysdb_cache_search_groups] (0x2000): Search groups with filter: (&(objectCategory=group)(ghost='aduser(a)ad.domain.com')) (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x561795c1c110 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x561795c16cf0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Running timer event 0x561795c1c110 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Destroying timer event 0x561795c16cf0 "ltdb_timeout" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Ending timer event 0x561795c1c110 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sysdb_cache_search_groups] (0x2000): No such entry (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x561795c16e00 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x561795c16cf0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Running timer event 0x561795c16e00 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Destroying timer event 0x561795c16cf0 "ltdb_timeout" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Ending timer event 0x561795c16e00 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sysdb_search_user_by_upn] (0x0400): No entry with upn ['aduser(a)ad.domain.com'] found. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_done] (0x0400): DP Request [Account #16]: Request handler finished [0]: Success (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [_dp_req_recv] (0x0400): DP Request [Account #16]: Receiving request data. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #16]: Finished. Success. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_reply_std] (0x1000): DP Request [Account #16]: Returning [Success]: 0,0,Success (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1:U:int.domain.com:name='aduser(a)ad.domain.com'] from reply table (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_destructor] (0x0400): DP Request [Account #16]: Request removed. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c16110], connected[1], ops[(nil)], ldap[0x561795c1df90] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sbus_dispatch] (0x4000): dbus conn: 0x561795bad8d0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sbus_dispatch] (0x4000): Dispatching. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name='aduser(a)ad.domain.com'] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_attach_req] (0x0400): DP Request [Account #17]: New request. Flags [0x0001]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain int.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain ad.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain int.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain ad.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaUserOverride)(uid='aduser))]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_print_server] (0x2000): Searching 10.10.60.61:389 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaUserOverride)(uid='aduser))][cn=Default Trust View,cn=views,cn=accounts,dc=int,dc=domain,dc=com]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 16 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_add] (0x2000): New operation 16 timeout 6 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c16110], connected[1], ops[0x561795c0b230], ldap[0x561795c1df90] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_destructor] (0x2000): Operation 16 finished (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaUserOverride)(uid='aduser))]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain int.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain ad.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ipa_srv_ad_acct_lookup_step] (0x0400): Looking up AD account (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain int.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain ad.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sss_domain_get_state] (0x1000): Domain ad.domain.com is Active (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_connect_step] (0x4000): beginning to connect (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'sd_ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [get_server_status] (0x1000): Status of server 'dc0.ad.domain.com' is 'working' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [get_server_status] (0x0100): Hostname resolution expired, resetting the server status of 'dc0.ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [set_server_common_status] (0x0100): Marking server 'dc0.ad.domain.com' as 'name not resolved' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'dc0.ad.domain.com' is 'working' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is expired (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [collapse_srv_lookup] (0x0100): Need to refresh SRV lookup for domain ad.domain.com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ad_srv_plugin_send] (0x0400): About to find domain controllers (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ad_get_dc_servers_send] (0x0400): Looking up domain controllers in domain ad.domain.com and site Default-First-Site-Name (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_discover_srv_next_domain] (0x0400): SRV resolution of service 'ldap'. Will use DNS discovery domain 'Default-First-Site-Name._sites.ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_ldap._tcp.Default-First-Site-Name._sites.ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c16110], connected[1], ops[(nil)], ldap[0x561795c1df90] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [request_watch_destructor] (0x0400): Deleting request watch (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_discover_srv_done] (0x0040): SRV query failed [4]: Domain name not found (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_discover_srv_next_domain] (0x0400): SRV resolution of service 'ldap'. Will use DNS discovery domain 'ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_ldap._tcp.ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_getsrv_done] (0x1000): Using TTL [600] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [request_watch_destructor] (0x0400): Deleting request watch (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_discover_srv_done] (0x0400): Got answer. Processing... (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_discover_srv_done] (0x0400): Got 1 servers (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ad_get_dc_servers_done] (0x0400): Found 1 domain controllers in domain ad.domain.com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ad_srv_plugin_dcs_done] (0x0400): About to locate suitable site (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_connect_host_send] (0x0400): Resolving host dc0.ad.domain.com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_is_address] (0x4000): [dc0.ad.domain.com] does not look like an IP address (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_step] (0x2000): Querying files (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'dc0.ad.domain.com' in files (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_step] (0x2000): Querying files (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of 'dc0.ad.domain.com' in files (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_step] (0x2000): Querying DNS (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'dc0.ad.domain.com' in DNS (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_dns_parse] (0x1000): Parsing an A reply (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [request_watch_destructor] (0x0400): Deleting request watch (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_connect_host_resolv_done] (0x0400): Connecting to ldap://dc0.ad.domain.com:389 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sssd_async_socket_init_send] (0x4000): Using file descriptor [30] for the connection. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://dc0.ad.domain.com:389/??base] with fd [30]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_connect_host_done] (0x0400): Successful connection to ldap://dc0.ad.domain.com:389 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_print_server] (0x2000): Searching 10.10.60.81:389 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(DnsDomain=ad.domain.com)(NtVer=\14\00\00\00))][]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [netlogon] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 1 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_add] (0x2000): New operation 1 timeout 6 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795bb41c0], connected[1], ops[0x561795c1ad50], ldap[0x561795bc93c0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_entry] (0x1000): OriginalDN: []. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [netlogon] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795bb41c0], connected[1], ops[0x561795c1ad50], ldap[0x561795bc93c0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_destructor] (0x2000): Operation 1 finished (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_handle_release] (0x2000): Trace: sh[0x561795bb41c0], connected[1], ops[(nil)], ldap[0x561795bc93c0], destructor_lock[0], release_memory[0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [remove_connection_callback] (0x4000): Successfully removed connection callback. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ad_get_client_site_done] (0x0400): Found site: Default-First-Site-Name (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ad_get_client_site_done] (0x0400): Found forest: ad.domain.com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ad_srv_plugin_site_done] (0x0400): About to discover primary and backup servers (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_discover_servers_send] (0x0400): Looking up primary servers (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_discover_srv_next_domain] (0x0400): SRV resolution of service 'ldap'. Will use DNS discovery domain 'Default-First-Site-Name._sites.ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_ldap._tcp.Default-First-Site-Name._sites.ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [request_watch_destructor] (0x0400): Deleting request watch (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_discover_srv_done] (0x0040): SRV query failed [4]: Domain name not found (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_discover_srv_next_domain] (0x0400): SRV resolution of service 'ldap'. Will use DNS discovery domain 'ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_ldap._tcp.ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_getsrv_done] (0x1000): Using TTL [600] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [request_watch_destructor] (0x0400): Deleting request watch (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_discover_srv_done] (0x0400): Got answer. Processing... (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_discover_srv_done] (0x0400): Got 1 servers (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ad_srv_plugin_servers_done] (0x0400): Got 1 primary and 0 backup servers (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_add_server_to_list] (0x0400): Inserted primary server 'dc0.ad.domain.com:389' to service 'sd_ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [set_srv_data_status] (0x0100): Marking SRV lookup of service 'sd_ad.domain.com' as 'resolved' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [get_server_status] (0x1000): Status of server 'dc0.ad.domain.com' is 'name not resolved' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_is_address] (0x4000): [dc0.ad.domain.com] does not look like an IP address (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_step] (0x2000): Querying files (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'dc0.ad.domain.com' in files (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [set_server_common_status] (0x0100): Marking server 'dc0.ad.domain.com' as 'resolving name' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_step] (0x2000): Querying files (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of 'dc0.ad.domain.com' in files (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_step] (0x2000): Querying DNS (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'dc0.ad.domain.com' in DNS (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolv_gethostbyname_dns_parse] (0x1000): Parsing an A reply (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [request_watch_destructor] (0x0400): Deleting request watch (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [set_server_common_status] (0x0100): Marking server 'dc0.ad.domain.com' as 'name resolved' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [be_resolve_server_process] (0x0200): Found address for server dc0.ad.domain.com: [10.10.60.81] TTL 600 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://dc0.ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://dc0.ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [krb5_add_krb5info_offline_callback] (0x4000): Removal callback already available for service [sd_ad.domain.com] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_2flUNz] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/pubconf/.krb5info_dummy_2flUNz] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sssd_async_socket_init_send] (0x4000): Using file descriptor [25] for the connection. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://dc0.ad.domain.com:389/??base] with fd [25]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_rootdse_send] (0x4000): Getting rootdse (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_print_server] (0x2000): Searching 10.10.60.81:389 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [*] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [altServer] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [namingContexts] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedControl] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedExtension] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedFeatures] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedLDAPVersion] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedSASLMechanisms] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [domainControllerFunctionality] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [defaultNamingContext] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [lastUSN] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [highestCommittedUSN] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 1 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_add] (0x2000): New operation 1 timeout 6 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c078f0], connected[1], ops[0x561795c15290], ldap[0x561795bc93c0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_entry] (0x1000): OriginalDN: []. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [currentTime] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [subschemaSubentry] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [dsServiceName] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [namingContexts] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [defaultNamingContext] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [schemaNamingContext] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [configurationNamingContext] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [rootDomainNamingContext] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedControl] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedLDAPVersion] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedLDAPPolicies] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [highestCommittedUSN] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedSASLMechanisms] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [dnsHostName] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ldapServiceName] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [serverName] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedCapabilities] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [isSynchronized] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [isGlobalCatalogReady] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedExtension] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [domainFunctionality] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [forestFunctionality] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [domainControllerFunctionality] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c078f0], connected[1], ops[0x561795c15290], ldap[0x561795bc93c0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_destructor] (0x2000): Operation 1 finished (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_rootdse_done] (0x2000): Got rootdse (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_rootdse_done] (0x2000): Skipping auto-detection of match rule (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_server_opts_from_rootdse] (0x4000): USN value: 49446 (int: 49446) (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [7] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_server_opts_from_rootdse] (0x0100): Will look for schema at [CN=Schema,CN=Configuration,DC=ad,DC=domain,DC=com] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_kinit_send] (0x0400): Attempting kinit (/var/lib/sss/keytabs/ad.domain.com.keytab, INTdomain$, AD.domain.COM, 86400) (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_kinit_next_kdc] (0x1000): Resolving next KDC for service sd_ad.domain.com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'sd_ad.domain.com' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [get_server_status] (0x1000): Status of server 'dc0.ad.domain.com' is 'name resolved' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [get_server_status] (0x1000): Status of server 'dc0.ad.domain.com' is 'name resolved' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [be_resolve_server_process] (0x0200): Found address for server dc0.ad.domain.com: [10.10.60.81] TTL 600 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_kinit_kdc_resolved] (0x1000): KDC resolved, attempting to get TGT... (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [create_tgt_req_send_buffer] (0x0400): buffer size: 94 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [2802] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [set_tgt_child_timeout] (0x0400): Setting 6 seconds timeout for TGT child (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c078f0], connected[1], ops[(nil)], ldap[0x561795bc93c0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [write_pipe_handler] (0x0400): All data has been sent! (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [read_pipe_handler] (0x0400): EOF received, client finished (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_tgt_recv] (0x0400): Child responded: 0 [FILE:/var/lib/sss/db/ccache_AD.domain.COM] expired on [1551019884] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_cli_auth_step] (0x1000): the connection will expire at 1550984784 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: INTdomain$ (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [child_sig_handler] (0x1000): Waiting for child [2802]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [child_sig_handler] (0x0100): child [2802] finished successfully. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_cli_connect_recv] (0x0400): Connection established. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [_be_fo_set_port_status] (0x8000): Setting status: PORT_WORKING. Called from: src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_recv: 2086 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'dc0.ad.domain.com' as 'working' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [set_server_common_status] (0x0100): Marking server 'dc0.ad.domain.com' as 'working' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [fo_set_port_status] (0x0400): Marking port 389 of duplicate server 'dc0.ad.domain.com' as 'working' (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_connect_done] (0x2000): Old USN: 49438, New USN: 49446 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_connect_done] (0x4000): notify connected to op #1 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [dc=ad,dc=domain,dc=com] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_print_server] (0x2000): Searching 10.10.60.81:389 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(|(userPrincipalName='aduser(a)ad.domain.com')(mail='aduser(a)ad.domain.com')(userPrincipalName='aduser\\(a)ad.domain.com'@AD.domain.COM))(objectclass=user)(sAMAccountName=*)(objectSID=*))][dc=ad,dc=domain,dc=com]. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixUserPassword] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPrincipalName] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [name] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectGUID] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [primaryGroupID] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [whenChanged] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userCertificate;binary] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [mail] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 5 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_add] (0x2000): New operation 5 timeout 6 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_connect_done] (0x4000): caching successful connection after 1 notifies (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [be_run_unconditional_online_cb] (0x4000): List of unconditional online callbacks is empty, nothing to do. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c078f0], connected[1], ops[0x561795c298a0], ldap[0x561795bc93c0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_add_references] (0x1000): Additional References: ldap://ForestDnsZones.ad.domain.com/DC=ForestDnsZones,DC=ad,DC=domain,DC=com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c078f0], connected[1], ops[0x561795c298a0], ldap[0x561795bc93c0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_add_references] (0x1000): Additional References: ldap://DomainDnsZones.ad.domain.com/DC=DomainDnsZones,DC=ad,DC=domain,DC=com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c078f0], connected[1], ops[0x561795c298a0], ldap[0x561795bc93c0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_ext_add_references] (0x1000): Additional References: ldap://ad.domain.com/CN=Configuration,DC=ad,DC=domain,DC=com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c078f0], connected[1], ops[0x561795c298a0], ldap[0x561795bc93c0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_op_destructor] (0x2000): Operation 5 finished (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [generic_ext_search_handler] (0x4000): Request included referrals which were ignored. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [generic_ext_search_handler] (0x4000): Ref: ldap://ForestDnsZones.ad.domain.com/DC=ForestDnsZones,DC=ad,DC=domain,DC=com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [generic_ext_search_handler] (0x4000): Ref: ldap://DomainDnsZones.ad.domain.com/DC=DomainDnsZones,DC=ad,DC=domain,DC=com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [generic_ext_search_handler] (0x4000): Ref: ldap://ad.domain.com/CN=Configuration,DC=ad,DC=domain,DC=com (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_search_user_process] (0x2000): Retrieved total 0 users (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_done] (0x4000): releasing operation connection (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x561795c16cf0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x561795c2a8f0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Running timer event 0x561795c16cf0 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Destroying timer event 0x561795c2a8f0 "ltdb_timeout" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Ending timer event 0x561795c16cf0 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sysdb_search_by_name] (0x0400): No such entry (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sysdb_cache_search_groups] (0x2000): Search groups with filter: (&(objectCategory=group)(ghost='aduser(a)ad.domain.com')) (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x561795c1c110 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x561795c2a8f0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Running timer event 0x561795c1c110 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Destroying timer event 0x561795c2a8f0 "ltdb_timeout" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Ending timer event 0x561795c1c110 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sysdb_cache_search_groups] (0x2000): No such entry (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x561795c16cf0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x561795c2a8f0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Running timer event 0x561795c16cf0 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Destroying timer event 0x561795c2a8f0 "ltdb_timeout" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ldb] (0x4000): Ending timer event 0x561795c16cf0 "ltdb_callback" (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sysdb_search_user_by_upn] (0x0400): No entry with upn ['aduser(a)ad.domain.com'] found. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [ipa_get_ad_acct_ad_part_done] (0x0080): Object not found, ending request (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_done] (0x0400): DP Request [Account #17]: Request handler finished [0]: Success (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [_dp_req_recv] (0x0400): DP Request [Account #17]: Receiving request data. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #17]: Finished. Success. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_reply_std] (0x1000): DP Request [Account #17]: Returning [Success]: 0,0,Success (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1:U:ad.domain.com:name='aduser(a)ad.domain.com'] from reply table (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_destructor] (0x0400): DP Request [Account #17]: Request removed. (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x561795c078f0], connected[1], ops[(nil)], ldap[0x561795bc93c0] (Sat Feb 23 23:51:24 2019) [sssd[be[int.domain.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list

4 15

unable to have ipa users only
by Albert Szostkiewicz 17 Mar '19

17 Mar '19

Now this might be more of a distro issue rather than IPA itself and I have already reported it on bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1688363) and tried to get any answers on ask fedora but no luck (https://ask.fedoraproject.org/en/question/133793/fresh-fedora-with-domain-o…) Long story short: 1. with fresh, new fedora 29 installation, instead of creating a user, i choose domain user 2. login as domain user, sessions starts and everything looks normal 3. after restart, i am being greet yet again with 'gnome-initial-setup' like no user exists 4. if i do create some some local user just for sake of not getting initial setup, and log-in as ipa domain user, any 'Administrator' authentication is asking for local user password (not the ipa user i am logged as). 5. if i would remove local user, i would get 'gnome-initial-setup' all over again So I was wondering if any of you had or heard about similar issues and ideas for solution. So far I've tried manually adding ipa user to wheel group but that did not help.

1 0

LDAP module configuration
by Boudjoudad Abdelkader 15 Mar '19

15 Mar '19

Hello Alexander and all, Can you someone please let me know what's the group object in LDAP 389 DS ? I have this path to search the groups but it's not returning results: In /etc/raddb/mods-enabled/ldap: ldap { server = 'freeipa.dc=server,dc=example,dc=com # port = 389 # identity = 'cn=admin,dc=server,dc=example,dc=com' # password = mypass base_dn = 'cn=users,cn=accounts,dc=server,dc=example,dc=com' ... } group { base_dn = 'cn=groups,cn=accounts,dc=server,dc=example,dc=com' dc=example,dc=com name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = memberOf ... } What i'm missing in group base_dn path ? Thanks,

2 4

No group membership attribute(s) found in user object
by Boudjoudad Abdelkader 15 Mar '19

15 Mar '19

Hi, I'm trying to check if user is in a given group name in LDAP but it doesn't work, here is the configuration: - vi /etc/raddb/mods-enabled/ldap ldap { ... base_dn = 'cn=users,cn=accounts,dc=server,dc=example,dc=com' ... } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' scope = 'sub' name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = memberOf cacheable_name = 'yes' cacheable_dn = 'yes' # cache_attribute = 'LDAP-Cached-Membership' The result: rlm_ldap (ldap): Reserved connection (2) (0) Using user DN from request "uid=ttest2,cn=users,cn=accounts,dc=server,dc=example,dc=com" (0) Checking for user in group objects (0) EXPAND (&(cn=ipausers)(objectClass=posixGroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (0) --> (&(cn=ipausers)(objectClass=posixGroup)(|(member=uid\3dttest2\2ccn\3dusers\2ccn\3daccounts\2cdc\3dserver\2cdc\3dexample\2cdc\3com)(memberUid=ttest2))) (0) Performing search in "cn=users,cn=accounts,dc=server,dc=example,dc=com" with filter "(&(cn=ipausers)(objectClass=posixGroup)(|(member=uid\3dttest2\2ccn\3dusers\2ccn\3daccounts\2cdc\3dserver\2cdc\3dexample\2cdc\3dcom)(memberUid=ttest2)))", scope "sub" (0) Waiting for search result... (0) Search returned no results (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "uid=ttest2,cn=users,cn=accounts,dc=server,dc=example,dc=com", scope "base" (0) Waiting for search result... (0) No group membership attribute(s) found in user object What i'm missing ? Thanks,

2 10

Resolution issues (SERVFAIL)
by Dmitry Perets 15 Mar '19

15 Mar '19

Hi, I am experiencing a strange issue with DNS resolution between my replicas, could you please help me to figure it out? My topology is: rhel-ipa.ims.example.com => rhel-ipa-replica.ams.ims.example.com => rhel-ipa-newreplica.ams.ims.example.com All three are IPA servers with DNS. And I've created two zones: "ims.example.com" and "ams.ims.example.com". It worked fine while I had just two first IPA servers, both servers could resolve any host in any of the two zones. But now I added the third IPA server (rhel-ipa-newreplica), and that new host cannot resolve anything in the parent domain "ims.example.com"... $ dig rhel-ipa.ims.telekom.de ; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> rhel-ipa.ims.example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 61092 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;rhel-ipa.ims.example.com. IN A ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Thu Mar 14 18:02:46 CET 2019 ;; MSG SIZE rcvd: 52 What am I missing here...? As per my understanding, each IPA server should "feel" authoritative for each of the two zones, because they are replicated. So even forwarding should not take place here... Btw I tried to play with forwarder configuration, but so far - no luck. What am I missing for this setup to work...? How to make rhel-ipa-newreplica to resolve hosts from parent domain...? -- Regards, Dmitry Perets. "The more one knows, the less opinions he shares" -- Wilhelm Schwebel

1 1

error 32 (No such object)
by Günther J. Niederwimmer 15 Mar '19

15 Mar '19

Hello, I found on the logs this Error, but I can't say what it mean? I have a primary IPA Server (ipa.example.com) and a secondary IPA Server (ipa1.example.com) I mean this is running now a long time. But on the "older" primary now I have this Errors. [15/Mar/2019:09:55:36.268953631 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:00:36.523786880 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:05:36.658511034 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:10:36.262165631 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:15:36.375852651 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:20:36.318006003 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:25:36.443969376 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:30:36.431541771 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:35:36.411241412 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) Can any please help for this Problem -- mit freundliche Grüßen / best regards, Günther J. Niederwimmer

1 0

Re: Configuring SSL Ciphers for FreeIPA / DogTag on port 8443
by Christopher Lamb 14 Mar '19

14 Mar '19

3 2

Configuring SSL Ciphers for FreeIPA / DogTag on port 8443
by Christopher Lamb 13 Mar '19

13 Mar '19

3 4

Sub-zone client fails to install, GSS authentication pre-auth issues
by Callum Smith 13 Mar '19

13 Mar '19

Dear IPA Gurus I have a client that's incapable of joining the FreeIPA realm, it's in a different DNS sub-zone but is in the same realm. I get the feeling that there's a kerberos principal missing somewhere to get this all to work, but I can't quite see where it might be. Simple authentication ldapsearch using cn=Directory Manager functions perfectly well to the ipa host in question, however anonymous binds are disabled. I'm not clear why this wouldn't be working. Regards, Callum -- Callum Smith Research Computing Core Wellcome Trust Centre for Human Genetics University of Oxford e. callum(a)well.ox.ac.uk<mailto:callum@well.ox.ac.uk>

2 30

problem access Linux shares from Windows "ticket is likely out of date"
by fujisan 13 Mar '19

13 Mar '19

I messed up somehow with my samba server. I'm trying to access a linux share from windows and the log on the linux server says: [Unspecified GSS failure. Minor code may provide more information: Request ticket server cifs/myserver.mydomain.local(a)MYDOMAIN.LOCAL kvno 8 not found in keytab; ticket is likely out of date] How can I fix this? Thank you. ----------------------------------------- # net ads keytab list Vno Type Principal 16 AES-256 CTS mode with 96-bit SHA-1 HMAC cifs/myserver.mydomain.local(a)MYDOMAIN.LOCAL 16 AES-128 CTS mode with 96-bit SHA-1 HMAC cifs/myserver.mydomain.local(a)MYDOMAIN.LOCAL ----------------------------------------- # net conf list [global] workgroup = MYDOMAIN.LOCAL netbios name = MYSERVER realm = MYDOMAIN.LOCAL kerberos method = dedicated keytab dedicated keytab file = /etc/samba/samba.keytab create krb5 conf = no security = user domain master = yes domain logons = yes log level = 1 max log size = 100000 log file = /var/log/samba/log.%m passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-MYDOMAIN-LOCAL.socket disable spoolss = yes ldapsam:trusted = yes ldap ssl = off ldap suffix = dc=mydomain,dc=local ldap user suffix = cn=users,cn=accounts ldap group suffix = cn=groups,cn=accounts ldap machine suffix = cn=computers,cn=accounts rpc_server:epmapper = external rpc_server:lsarpc = external rpc_server:lsass = external rpc_server:lsasd = external rpc_server:samr = external rpc_server:netlogon = external rpc_server:tcpip = yes rpc_daemon:epmd = fork rpc_daemon:lsasd = fork [scratch] path = /data/scratch comment = Scratch shared files create mask = 0644 invalid users = opera

3 12

nfsidmap/nss_getpwnam fails to resolve users with IPA/NFSv4+krb5
by Robert Sturrock 12 Mar '19

12 Mar '19

Hi All. We have IPA setup in an AD trust to support our Linux fleet. I’m running into a problem trying to get Ubuntu (16.04) clients to resolve names/ids on an NFS-mounted filesystem from an NFS server using NFSv4/krb5. Files and directories show up as ‘nobody’ or an incorrect numerical ID when listed with ‘ls’. RHEL7 clients seem to working fine with a very similar configuration (as far as I can tell). The particulars are: - AD forest has domains ‘localdomain’ and ‘student.localdomain’ (my user identity is ‘user@localdomain’) - IPA domain is ‘ipa.localdomain’ - The NFS server (RHEL7) and clients (Ubu16.04, RHEL7) are both enrolled to IPA (with 'Domain=ipa.localdomain’ in /etc/idmapd.conf). I have mounted the NFS volume on the clients with a simple: mount -t nfs4 nfs-server.ipa.localdomain:/export /mnt Listing my directory as myself (‘rns@localdomain’) on the Ubuntu client, I see: $ ls -ld rns drwx------ 18 nobody 4294967294 4096 Oct 25 15:18 rns .. with these corresponding nfsidmap messages: Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: key: 0x2c254c26 type: uid value: rns@localdomain@ipa.localdomain timeout 600 Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nfs4_name_to_uid: calling nsswitch->name_to_uid Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nss_getpwnam: name 'rns@localdomain@ipa.localdomain' domain 'ipa.localdomain': resulting localname '(null)' Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nss_getpwnam: name 'rns@localdomain@ipa.localdomain' does not map into domain 'ipa.localdomain' Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nfs4_name_to_uid: nsswitch->name_to_uid returned -22 Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nfs4_name_to_uid: final return value is -22 .. whereas on the RHEL7 client, I see: $ ls -ld rns drwx------. 18 rns@localdomain rns@localdomain 4096 Oct 25 15:18 rns Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30590]: key: 0xf113fd2 type: uid value: rns@localdomain@ipa.localdomain timeout 600 Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30590]: nfs4_name_to_uid: calling nsswitch->name_to_uid Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30590]: nss_getpwnam: name 'rns@localdomain@ipa.localdomain' domain 'ipa.localdomain': resulting localname 'rns@localdomain' Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30590]: nfs4_name_to_uid: nsswitch->name_to_uid returned 0 Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30590]: nfs4_name_to_uid: final return value is 0 Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30592]: key: 0x2125a5d2 type: gid value: rns@localdomain@ipa.localdomain timeout 600 Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30592]: nfs4_name_to_gid: calling nsswitch->name_to_gid Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30592]: nfs4_name_to_gid: nsswitch->name_to_gid returned 0 Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30592]: nfs4_name_to_gid: final return value is 0 Why does the Ubuntu client's nfsidmap think that my identity doesn’t map into ‘ipa.localdomain’ and therefore (presumably) returns the error code ‘-22’? (My identity resolves ok from the shell, using ‘id rns@localdomain’ and I can login and use local filesystems without issue). The idmapd.conf looks like this: [General] Verbosity = 4 Pipefs-Directory = /run/rpc_pipefs Domain = ipa.localdomain Local-Realms = LOCALDOMAIN, STUDENT.LOCALDOMAIN, IPA.LOCALDOMAIN [Mapping] Nobody-User = nobody Nobody-Group = nogroup [Translation] Method = nsswitch Any pointers appreciated! Regards, Robert.

3 5

Problem with CA replica
by Gregory S 12 Mar '19

12 Mar '19

Hi all, i get the following error when i try to get the certificates from a CA replica server mng-ldap-03 [~] # ipa -d cert-show 1 ipa: DEBUG: Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' ipa: DEBUG: importing all plugin modules in ipaclient.remote_plugins.schema$bd29a1fe... ipa: DEBUG: importing plugin module ipaclient.remote_plugins.schema$bd29a1fe.plugins ipa: DEBUG: importing all plugin modules in ipaclient.plugins... ipa: DEBUG: importing plugin module ipaclient.plugins.automember ipa: DEBUG: importing plugin module ipaclient.plugins.automount ipa: DEBUG: importing plugin module ipaclient.plugins.ca ipa: DEBUG: importing plugin module ipaclient.plugins.cert ipa: DEBUG: importing plugin module ipaclient.plugins.certmap ipa: DEBUG: importing plugin module ipaclient.plugins.certprofile ipa: DEBUG: importing plugin module ipaclient.plugins.dns ipa: DEBUG: importing plugin module ipaclient.plugins.hbacrule ipa: DEBUG: importing plugin module ipaclient.plugins.hbactest ipa: DEBUG: importing plugin module ipaclient.plugins.host ipa: DEBUG: importing plugin module ipaclient.plugins.idrange ipa: DEBUG: importing plugin module ipaclient.plugins.internal ipa: DEBUG: importing plugin module ipaclient.plugins.location ipa: DEBUG: importing plugin module ipaclient.plugins.migration ipa: DEBUG: importing plugin module ipaclient.plugins.misc ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken_yubikey ipa: DEBUG: importing plugin module ipaclient.plugins.passwd ipa: DEBUG: importing plugin module ipaclient.plugins.permission ipa: DEBUG: importing plugin module ipaclient.plugins.rpcclient ipa: DEBUG: importing plugin module ipaclient.plugins.server ipa: DEBUG: importing plugin module ipaclient.plugins.service ipa: DEBUG: importing plugin module ipaclient.plugins.sudorule ipa: DEBUG: importing plugin module ipaclient.plugins.topology ipa: DEBUG: importing plugin module ipaclient.plugins.trust ipa: DEBUG: importing plugin module ipaclient.plugins.user ipa: DEBUG: importing plugin module ipaclient.plugins.vault ipa: DEBUG: found session_cookie in persistent storage for principal 'admin(a)my.domain', cookie: 'ipa_session=MagBearerToken=lsJGxN13dNkJaPLbXlPn9idZCIlIOK%2be7GbleRo4NwXi5em27AGEQpZ4EGU2lduSKdurilHDrpYzlND8kfoA%2fwqpOh%2fSkG4kbXR%2baSeDKKi%2bJov9sTB8Oa1FkUKtLRWbW6nw%2feI1jQIT8lFKjIrfufQnsNz2uI0Jybk7BwelAWc%3d' ipa: DEBUG: setting session_cookie into context 'ipa_session=MagBearerToken=lsJGxN13dNkJaPLbXlPn9idZCIlIOK%2be7GbleRo4NwXi5em27AGEQpZ4EGU2lduSKdurilHDrpYzlND8kfoA%2fwqpOh%2fSkG4kbXR%2baSeDKKi%2bJov9sTB8Oa1FkUKtLRWbW6nw%2feI1jQIT8lFKjIrfufQnsNz2uI0Jybk7BwelAWc%3d;' ipa: INFO: trying https://mng-ldap-03.my.domain/ipa/session/json ipa: DEBUG: New HTTP connection (mng-ldap-03.my.domain) ipa: DEBUG: received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=lsJGxN13dNkJaPLbXlPn9idZCIlIOK%2be7GbleRo4NwXi5em27AGEQpZ4EGU2lduSKdurilHDrpYzlND8kfoA%2fwqpOh%2fSkG4kbXR%2baSeDKKi%2bJov9sTB8Oa1FkUKtLRWbW6nw%2feI1jQIT8lFKjIrfufQnsNz2uI0Jybk7BwelAWc%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=lsJGxN13dNkJaPLbXlPn9idZCIlIOK%2be7GbleRo4NwXi5em27AGEQpZ4EGU2lduSKdurilHDrpYzlND8kfoA%2fwqpOh%2fSkG4kbXR%2baSeDKKi%2bJov9sTB8Oa1FkUKtLRWbW6nw%2feI1jQIT8lFKjIrfufQnsNz2uI0Jybk7BwelAWc%3d;' for principal admin(a)my.domain ipa: DEBUG: Created connection context.rpcclient_140079354213072 ipa: DEBUG: raw: cert_show(u'1', version=u'2.228') ipa: DEBUG: cert_show(u'1', version=u'2.228') ipa: INFO: [try 1]: Forwarding 'cert_show/1' to json server 'https://mng-ldap-03.my.domain/ipa/session/json' ipa: DEBUG: HTTP connection keep-alive (mng-ldap-03.my.domain) ipa: DEBUG: received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=lsJGxN13dNkJaPLbXlPn9idZCIlIOK%2be7GbleRo4NwXi5em27AGEQpZ4EGU2lduSKdurilHDrpYzlND8kfoA%2fwqpOh%2fSkG4kbXR%2baSeDKKi%2bJov9sTB8Oa1FkUKtLRWbW6nw%2feI1jQIT8lFKjIrfufQnsNz2uI0Jybk7BwelAWc%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=lsJGxN13dNkJaPLbXlPn9idZCIlIOK%2be7GbleRo4NwXi5em27AGEQpZ4EGU2lduSKdurilHDrpYzlND8kfoA%2fwqpOh%2fSkG4kbXR%2baSeDKKi%2bJov9sTB8Oa1FkUKtLRWbW6nw%2feI1jQIT8lFKjIrfufQnsNz2uI0Jybk7BwelAWc%3d;' for principal admin(a)my.domain ipa: DEBUG: Destroyed connection context.rpcclient_140079354213072 ipa: ERROR: Certificate operation cannot be completed: EXCEPTION (Invalid Credential.)

1 0

Unable to login via ssh with AD credentials after upgrade FreeIPA
by Morgan Marodin 12 Mar '19

12 Mar '19

Hi everybody. I have just upgraded my cluster from FreeIPA 4.4.0-14 to 4.6.4-10. All is good, logging via IPA credentials, HBAC and sudo rules are working. I have only a issue logging via SSH with AD credentials. Before the upgrade all was working well. I think that the trust is ok, because *kinit*, *ipa hbactest* and *ipa trustdomain-find* (on both ipa servers) are working well: *[root@mlv-ipasrv01 ~]# ipa trustdomain-find MYDOMAIN.COM <http://MYDOMAIN.COM> Domain name: mydomain.com <http://mydomain.com> Domain NetBIOS name: MYDOMAIN Domain Security Identifier: S-1-5-21-3367759252-2451474351-126822339 Domain enabled: True----------------------------Number of entries returned 1----------------------------[root@mlv-ipasrv01 ~]# ipa hbactest --user=morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com> --host=mlv-testipa01.ipa.mydomain.com <http://mlv-testipa01.ipa.mydomain.com>Service: sshd--------------------Access granted: True-------------------- Matched rules: allow_ad_ipa_admins Not matched rules: allow_ad_ipa_apps Not matched rules: allow_ipa_it_mysite[root@mlv-testipa01 ~]# kinit morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com>Password for morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com>:[root@mlv-testipa01 ~]# klistTicket cache: KEYRING:persistent:0:0Default principal: morgan.marodin(a)MYDOMAIN.COM <morgan.marodin(a)MYDOMAIN.COM>Valid starting Expires Service principal02/19/2019 17:55:23 02/20/2019 03:55:23 krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM <MYDOMAIN.COM(a)MYDOMAIN.COM> renew until 02/20/2019 17:55:18* This is the error log: *[root@mlv-testipa01 ~]# tail -f /var/log/secureFeb 19 18:03:21 mlv-testipa01 sshd[378408]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.252 user=morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com>Feb 19 18:03:21 mlv-testipa01 sshd[378408]: pam_sss(sshd:account): Access denied for user morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com>: 6 (Permission denied)Feb 19 18:03:21 mlv-testipa01 sshd[378401]: error: PAM: User account has expired for morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com> from 192.168.100.252Feb 19 18:03:21 mlv-testipa01 sshd[378401]: fatal: monitor_read: unpermitted request 104* It seems a problem with pam and sssd. Do you have any suggestions? Thanks, bye. Morgan

2 18

Web App and Kerberos Delegation
by Dmitry Perets 11 Mar '19

11 Mar '19

Hi, My Web Server is enrolled in the FreeIPA domain, but the clients are external. So login is done via a custom login form - part of the Web Application. In this setup, I know how to authenticate the clients to the Web Application using FreeIPA as a backend - I can use mod_intercept_form_submit, and it works just fine. But what if I need to obtain Kerberos credentials on behalf of the current user? (I believe, smart people call it "delegation" in Kerberos world). To be more specific - suppose that the Web Application features personal secret vaults, and it uses FreeIPA Vaults as a backend. So, a user X logs in, he wants to see his personal vaults - the Web Application must obtain Kerberos credentials on his behalf (not on HTTP/.... service behalf, because I don't want to make it owner of all vaults). Or another example - suppose that the Web Application manages my infrastructure. So a user X (who is infra-admin) logs in and requests to add a new host to the domain. The Web Application must then go and execute some privileged FreeIPA calls (like host_add etc.). Again, I'd like it to authenticate on behalf of this user X, instead of making the HTTP/... service infra-admin by itself. This way I don't need to store any passwords or keytabs with such sensitive credentials (the infra-admin will always come in person and type his password). Can you please point me to the right direction? Thanks.

1 0

freeipa client on Ubuntu SSH fails
by Will Kay 11 Mar '19

11 Mar '19

Hi all, Issue: We have freeipa servers set and tests are good with CentOS 7.6 clients. We are trying to test Ubuntu 16.04 and 18.04 clients. After running ipa-client-install, we can't ssh login the Ubuntu's with ipa user accounts. If we login as root, `ipa user-show xxx` looks fine on the Ubuntu's. Where should we start looking from here? Background: One freeipa 4.6.4 master and two replicas setup on CentOS 7.6.1810. All seems to work fine. `ipa user-show xxx` test works across the replicas. I also have two CentOS client installed. SSH login and sudo command group tests are good. We are very happy with the test result so far. we just need to move on to client tests with Ubuntu 16.04, 18.04 and RH7 thanks Wil

2 5

FreeIPA causing issues with SMB shares
by Kristian Petersen 11 Mar '19

11 Mar '19

We have been using IPA with a number of Ubuntu workstations, but have had to remove freeipa-client from them because something that happens when enrolling them prevents them from mounting SMB shares from our fileserver. Is there a simple expanation as to why this happens? The shares work fine before enrollment and after removing freeipa-client. -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

1 0

IPA install with custom CA fails at SSL: CERTIFICATE_VERIFY_FAILED
by Jonny McCullagh 11 Mar '19

11 Mar '19

I can install freeipa with ipa-server-install and no parameters fine. However I want to be able to use IPA as a sub-CA. I have created root and intermediate CAs using openssl and attempt to install ipa server with: /usr/sbin/ipa-server-install --external-cert-file=/root/thisserver.domain.dev.cert.pem \ --external-cert-file=/root/intermediate.cert.pem \ --external-cert-file=/root/root-ca.cert.pem \ --external-ca -n domain.dev -r DOMAIN.DEV \ --hostname="thisserver.domain.dev" \ --subject="O=Acme Inc, L=Springfield, ST=Ohio, C=US" \ --ds-password=topsecret --admin-password=opensesame It stops at step 24 with the following message: [20/28]: Configure HTTP to proxy connections [21/28]: restarting certificate server [22/28]: updating IPA configuration [23/28]: enabling CA instance [24/28]: migrating certificate profiles to LDAP [error] NetworkError: cannot connect to 'https://thisserver.domain.dev:8443/ca/rest/account/login': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) ipapython.admintool: ERROR cannot connect to 'https://thisserver.domain.dev:8443/ca/rest/account/login': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information If I visit the address on port 8443 I do get an error I believe due to an empty certificate. My browser shows: Certificate path length constraint is invalid. Error code: SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID So I have a few questions if anyone can guide me: 1. Can I resume the install to complete the last 4 installation steps? 2. How can I get the install to use a self-signed cert for the http/ldap service OR can I supply a signed cert for that purpose? Thanks in advance. IPA version: 4.6.4-10.el7.centos.2.x86_64 OS: CentOS 7.6

2 2

Re: FreeIPA-users Digest, Vol 23, Issue 8
by Julian Gethmann 11 Mar '19

11 Mar '19

Hello Anthony, I don't know if there is an official tool for that, but since I once wrote a similar script, you might be happy with that. It requires that your Python 3 installation has got the IPA libraries installed and you have got a valid Kerberos ticket. I have tested it only on Fedora so far. I hope it's useful for you and you can modify it to your needs. Regards, Julian On 09/03/2019 05.03, freeipa-users-request(a)lists.fedorahosted.org wrote: > Date: Fri, 8 Mar 2019 11:50:55 -0500 > From: Anthony Jarvis-Clark<anthonyclarka2(a)gmail.com> > Subject: [Freeipa-users] list all users and their password expiration > date? > To: FreeIPA users list<freeipa-users(a)lists.fedorahosted.org> > Message-ID: > <CAJGYKdMpG5ovFfLoa8w0VqSnd1A__awvzbqe3kfTF1w+My86mQ(a)mail.gmail.com> > Content-Type: multipart/alternative; > boundary="0000000000006d0281058398074b" > > --0000000000006d0281058398074b > Content-Type: text/plain; charset="UTF-8" > > Hello Everyone, > > Is there a command line method to get a list of users and their password > expiration date? > > Thanks! > > -Anthony > > --0000000000006d0281058398074b > Content-Type: text/html; charset="UTF-8" > > <div dir="ltr">Hello Everyone,<div><br></div><div>Is there a command line method to get a list of users and their password expiration date?</div><div><br></div><div>Thanks!</div><div><br></div><div>-Anthony</div></div> > > --0000000000006d0281058398074b--

2 1

Web app integration
by Alex Corcoles 11 Mar '19

11 Mar '19

Hi, I've read: https://www.freeipa.org/page/Web_App_Authentication , but there is some stuff that is not clear to me. 1) SAML As I recall, there's Ipsilon and Keycloak. Ipsilon is "dead" and Keycloak is the way to go, right? However, Keycloak setup is not trivial, correct? Running CentOS there is no straightforward way to install and integrate it with a FreeIPA domain, correct? 2) SSO What is the special sauce for users using a browser on an IPA-joined system to log in to apps without even seeing a login form? SPNEGO? I'm using mod_auth_gssapi for some apps, having httpd do the authentication and forward it through REMOTE_USER, but it doesn't do the magic. There are some hints on mod_auth_gssapi's docs, but nothing really clear. 3) How should you deliver apps? Suppose you are a web app developer and you want to deliver a web application which can easily integrate with FreeIPA. What's the most comfortable option you can give? (assuming, for instance, that you want the SSO magic sauce). Is there any difference between apps that will run on the FreeIPA's domain owner's systems or third party apps? Cheers, Álex -- ___ {~._.~} ( Y ) ()~*~() mail: alex at corcoles dot net (_)-(_) http://alex.corcoles.net/

3 12

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2019