FreeIPA-users September 2026

freeipa-users@lists.fedorahosted.org

16 participants
11 discussions

Freeipa on EL8 has stopped authenticating
by Brian J. Murrell 15 Oct '26

15 Oct '26

My FreeIPA server 4.9.13 on EL8 (yes, I know, it's getting long in the tooth -- I had an EL9 replica that I was using to migrate away from EL8 on but it STB) has started failing user authentications on my network for all services: ssh, sudo, etc. I have no clue why. Here is the output of a few sssd processes when an ssh fails: ==> /var/log/sssd/sssd_nss.log <== (2026-09-24 14:50:27): [nss] [get_client_cred] (0x4000): Client [0x557ffdc04240][21] creds: euid[0] egid[0] pid[943432] cmd_line['sshd-session: brian [priv]']. (2026-09-24 14:50:27): [nss] [setup_client_idle_timer] (0x4000): Idle timer re-set for client [0x557ffdc04240][21] (2026-09-24 14:50:27): [nss] [accept_fd_handler] (0x0400): [CID#58] Client [cmd sshd-session: brian [priv]][uid 0][0x557ffdc04240][21] connected! (2026-09-24 14:50:27): [nss] [sss_cmd_get_version] (0x0200): [CID#58] Received client version [1]. (2026-09-24 14:50:27): [nss] [sss_cmd_get_version] (0x0200): [CID#58] Offered version [1]. (2026-09-24 14:50:27): [nss] [sss_nss_getby_name] (0x0400): [CID#58] Input name: pam_usertype_non_existent: (2026-09-24 14:50:27): [nss] [cache_req_set_plugin] (0x2000): [CID#58] CR #225: Setting "User by name" plugin (2026-09-24 14:50:27): [nss] [cache_req_send] (0x0400): [CID#58] CR #225: REQ_TRACE: New request [CID #58] 'User by name' (2026-09-24 14:50:27): [nss] [cache_req_process_input] (0x0400): [CID#58] CR #225: Parsing input name [pam_usertype_non_existent:] (2026-09-24 14:50:27): [nss] [sss_parse_name] (0x0200): [CID#58] Domain not provided! (2026-09-24 14:50:27): [nss] [sss_parse_name_for_domains] (0x0200): [CID#58] name 'pam_usertype_non_existent:' matched without domain, user is pam_usertype_non_existent: (2026-09-24 14:50:27): [nss] [sss_nss_get_object_send] (0x0400): [CID#58] Client [0x557ffdc04240][21]: sent cache request #225 (2026-09-24 14:50:27): [nss] [cache_req_set_name] (0x0400): [CID#58] CR #225: Setting name [pam_usertype_non_existent:] (2026-09-24 14:50:27): [nss] [cache_req_select_domains] (0x0400): [CID#58] CR #225: Performing a multi-domain search (2026-09-24 14:50:27): [nss] [cache_req_search_domains] (0x0400): [CID#58] CR #225: Search will check the cache and check the data provider (2026-09-24 14:50:27): [nss] [cache_req_validate_domain_type] (0x2000): [CID#58] Request type POSIX-only for domain example.com type POSIX is valid (2026-09-24 14:50:27): [nss] [cache_req_set_domain] (0x0400): [CID#58] CR #225: Using domain [example.com] (2026-09-24 14:50:27): [nss] [cache_req_prepare_domain_data] (0x0400): [CID#58] CR #225: Preparing input data for domain [example.com] rules (2026-09-24 14:50:27): [nss] [cache_req_search_send] (0x0400): [CID#58] CR #225: Looking up pam_usertype_non_existent:@example.com (2026-09-24 14:50:27): [nss] [cache_req_search_ncache] (0x0400): [CID#58] CR #225: Checking negative cache for [pam_usertype_non_existent:@example.com] (2026-09-24 14:50:27): [nss] [sss_ncache_check_str] (0x2000): [CID#58] Checking negative cache for [NCE/USER/example.com/pam_usertype_non_existent:@example.com] (2026-09-24 14:50:27): [nss] [cache_req_search_ncache] (0x0400): [CID#58] CR #225: [pam_usertype_non_existent:@example.com] is not present in negative cache (2026-09-24 14:50:27): [nss] [cache_req_search_cache] (0x0400): [CID#58] CR #225: Looking up [pam_usertype_non_existent:@example.com] in cache (2026-09-24 14:50:27): [nss] [cache_req_search_cache] (0x0400): [CID#58] CR #225: Object [pam_usertype_non_existent:@example.com] was not found in cache (2026-09-24 14:50:27): [nss] [cache_req_search_dp] (0x0400): [CID#58] CR #225: Looking up [pam_usertype_non_existent:@example.com] in data provider (2026-09-24 14:50:27): [nss] [sss_dp_get_account_send] (0x0400): [CID#58] Creating request for [example.com][0x1][BE_REQ_USER][name=pam_usertype_non_existent:@example.com:-] ==> /var/log/sssd/sssd_example.com.log <== (2026-09-24 14:50:27): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd from sssd.nss (2026-09-24 14:50:27): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.nss] (2026-09-24 14:50:27): [be[example.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@example.com] (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#135] DP Request [Account #135]: REQ_TRACE: New request. [sssd.nss CID #58] Flags [0x0001]. (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#135] Number of active DP request: 1 (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#135] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#135] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#135] reusing cached connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#135] Marking connection as not idle (2026-09-24 14:50:27): [be[example.com]] [sdap_search_user_next_base] (0x0400): [RID#135] Searching for users with base [cn=accounts,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#135] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#135] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(uid=pam_usertype_non_existent:)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))] base: [cn=accounts,dc=example,dc=com]; msgid = 85 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [uid] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [userPassword] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [uidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [gidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [gecos] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [homeDirectory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [loginShell] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [krbPrincipalName] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [ipaNTSecurityIdentifier] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [modifyTimestamp] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [entryUSN] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowLastChange] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowMin] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowMax] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowWarning] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowInactive] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowExpire] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [shadowFlag] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [krbLastPwdChange] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [krbPasswordExpiration] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [pwdAttribute] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [authorizedService] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [accountExpires] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [userAccountControl] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [nsAccountLock] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [host] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [loginDisabled] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [loginExpirationTime] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [loginAllowedTimeMap] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [ipaSshPubKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [ipaUserAuthType] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [userCertificate;binary] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [mail] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [sAMAccountName] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#135] Requesting attrs: [ipaPassKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#135] New operation 85 timeout 6 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0010e0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#135] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#135] Handling LDAP operation [85][server: [10.75.22.247:389] filter: [(&(uid=pam_usertype_non_existent:)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))] base: [cn=accounts,dc=example,dc=com]] took [0.468] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#135] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#135] Operation 85 finished (2026-09-24 14:50:27): [be[example.com]] [sdap_search_user_process] (0x0400): [RID#135] Search for users, returned 0 results. (2026-09-24 14:50:27): [be[example.com]] [sdap_search_user_process] (0x2000): [RID#135] Retrieved total 0 users (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_done] (0x4000): [RID#135] releasing operation connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_idle] (0x4000): [RID#135] Marking connection as idle (2026-09-24 14:50:27): [be[example.com]] [sysdb_search_by_name] (0x0400): [RID#135] No such entry (2026-09-24 14:50:27): [be[example.com]] [sysdb_cache_search_groups] (0x2000): [RID#135] Search groups with filter: (&(objectCategory=group)(ghost=pam_usertype_non_existent:@example.com)) (2026-09-24 14:50:27): [be[example.com]] [sysdb_cache_search_groups] (0x2000): [RID#135] No such entry (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_user] (0x0400): [RID#135] Error: 2 (No such file or directory) (2026-09-24 14:50:27): [be[example.com]] [sysdb_search_by_name] (0x0400): [RID#135] No such entry (2026-09-24 14:50:27): [be[example.com]] [get_object_from_cache] (0x0200): [RID#135] Object wasn't found in cache (2026-09-24 14:50:27): [be[example.com]] [ipa_id_get_account_info_orig_done] (0x0080): [RID#135] Object not found, ending request (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x0400): [RID#135] DP Request [Account #135]: Request handler finished [0]: Success (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x20000): [RID#135] DP Request [Account #135]: Handling request took [1.158] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [_dp_req_recv] (0x0400): [RID#135] DP Request [Account #135]: Receiving request data. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#135] DP Request [Account #135]: Request removed. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#135] Number of active DP request: 0 (2026-09-24 14:50:27): [be[example.com]] [dp_req_reply_std] (0x1000): [RID#135] DP Request [Account #135]: Returning [Success]: 0,0,Success (2026-09-24 14:50:27): [be[example.com]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo on /sssd from sssd.nss: Success (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[(nil)], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list ==> /var/log/sssd/sssd_nss.log <== (2026-09-24 14:50:27): [nss] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [nss] [cache_req_search_cache] (0x0400): [CID#58] CR #225: Looking up [pam_usertype_non_existent:@example.com] in cache (2026-09-24 14:50:27): [nss] [cache_req_search_cache] (0x0400): [CID#58] CR #225: Object [pam_usertype_non_existent:@example.com] was not found in cache (2026-09-24 14:50:27): [nss] [cache_req_search_ncache_add_to_domain] (0x0400): [CID#58] CR #225: Adding [pam_usertype_non_existent:@example.com] to negative cache (2026-09-24 14:50:27): [nss] [sss_ncache_set_str] (0x0400): [CID#58] Adding [NCE/USER/example.com/pam_usertype_non_existent:@example.com] to negative cache (2026-09-24 14:50:27): [nss] [cache_req_global_ncache_add] (0x2000): [CID#58] CR #225: This request type does not support global negative cache (2026-09-24 14:50:27): [nss] [cache_req_process_result] (0x0400): [CID#58] CR #225: Finished: Not found (2026-09-24 14:50:27): [nss] [sss_nss_protocol_done] (0x4000): [CID#58] Sending reply: not found ==> /var/log/sssd/sssd_example.com.log <== (2026-09-24 14:50:27): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd from sssd.pam (2026-09-24 14:50:27): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.pam] (2026-09-24 14:50:27): [be[example.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#136] DP Request [Initgroups #136]: REQ_TRACE: New request. [sssd.pam CID #15] Flags [0x0001]. (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#136] Number of active DP request: 1 (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#136] reusing cached connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#136] Marking connection as not idle (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_send] (0x4000): [RID#136] Retrieving info for initgroups call (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#136] reusing cached connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#136] Marking connection as not idle (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_next_base] (0x0400): [RID#136] Searching for users with base [cn=accounts,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#136] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#136] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(uid=brian)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))] base: [cn=accounts,dc=example,dc=com]; msgid = 86 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [uid] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [userPassword] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [uidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [gidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [gecos] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [homeDirectory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [loginShell] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [krbPrincipalName] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaNTSecurityIdentifier] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [modifyTimestamp] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [entryUSN] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowLastChange] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowMin] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowMax] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowWarning] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowInactive] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowExpire] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [shadowFlag] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [krbLastPwdChange] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [krbPasswordExpiration] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [pwdAttribute] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [authorizedService] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [accountExpires] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [userAccountControl] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [nsAccountLock] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [host] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [loginDisabled] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [loginExpirationTime] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [loginAllowedTimeMap] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaSshPubKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaUserAuthType] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [userCertificate;binary] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [mail] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [sAMAccountName] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaPassKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#136] New operation 86 timeout 6 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edcef6100], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#136] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#136] Handling LDAP operation [86][server: [10.75.22.247:389] filter: [(&(uid=brian)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))] base: [cn=accounts,dc=example,dc=com]] took [0.895] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#136] OriginalDN: [uid=brian,cn=users,cn=accounts,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [uid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [uidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [gidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [gecos] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [homeDirectory] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [loginShell] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [krbPrincipalName] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [ipaNTSecurityIdentifier] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [modifyTimestamp] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [entryUSN] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [krbLastPwdChange] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [krbPasswordExpiration] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#136] No sub-attributes for [mail] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edcef6100], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#136] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#136] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#136] Operation 86 finished (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_user] (0x4000): [RID#136] Receiving info for the user (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_user] (0x4000): [RID#136] Storing the user (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x0400): [RID#136] Save user (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x4000): [RID#136] Failed to retrieve UUID [2][No such file or directory]. (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object brian (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x0400): [RID#136] Processing user brian(a)example.com (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x2000): [RID#136] Adding originalDN [uid=brian,cn=users,cn=accounts,dc=example,dc=com] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x0400): [RID#136] Adding original memberOf attributes to [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#136] Adding original mod-Timestamp [20260924173633Z] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x0400): [RID#136] Adding user principal [brian(a)EXAMPLE.COM] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowLastChange is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowMin is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowMax is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowWarning is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowInactive is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowExpire is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] shadowFlag is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#136] Adding krbLastPwdChange [20150924101933Z] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#136] Adding krbPasswordExpiration [20700627101933Z] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] pwdAttribute is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] authorizedService is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] adAccountExpires is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] adUserAccountControl is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] nsAccountLock is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] authorizedHost is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] authorizedRHost is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] ndsLoginDisabled is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] ndsLoginExpirationTime is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] ndsLoginAllowedTimeMap is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] sshPublicKey is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] authType is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] userCertificate is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#136] Adding mail [brian(a)example.com] to attributes of [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] adSAMAccountName is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x4000): [RID#136] userPasskey is not available for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_save_user] (0x0400): [RID#136] Storing info for user brian(a)example.com (2026-09-24 14:50:27): [be[example.com]] [sysdb_set_entry_attr] (0x0200): [RID#136] Entry [name=brian(a)example.com,cn=users,cn=example.com,cn=sysdb] has set [ts_cache] attrs. (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [userPassword] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [uniqueID] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowLastChange] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowMin] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowMax] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowWarning] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowInactive] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowExpire] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [shadowFlag] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [pwdAttribute] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [authorizedService] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [adAccountExpires] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [adUserAccountControl] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [nsAccountLock] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [authorizedHost] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [ndsLoginDisabled] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [ndsLoginExpirationTime] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [ndsLoginAllowedTimeMap] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [sshPublicKey] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [authType] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [userCertificate] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [adSAMAccountName] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_remove_attrs] (0x4000): [RID#136] Removing attribute [userPasskey] from [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_store_user] (0x0400): [RID#136] User "brian(a)example.com" has been stored (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_user] (0x4000): [RID#136] Commit change (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_user] (0x4000): [RID#136] Process user's groups (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object brian (2026-09-24 14:50:27): [be[example.com]] [sdap_has_deref_support_ex] (0x0400): [RID#136] The server supports deref method OpenLDAP (2026-09-24 14:50:27): [be[example.com]] [sdap_deref_search_send] (0x2000): [RID#136] Server supports OpenLDAP deref (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_search_send] (0x0400): [RID#136] Dereferencing entry [uid=brian,cn=users,cn=accounts,dc=example,dc=com] using OpenLDAP deref (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#136] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_send] (0x0400): [RID#136] WARNING: Disabling paging because scope is set to base. (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#136] ldap_search_ext called: server: [10.75.22.247:389] filter: [(null)] base: [uid=brian,cn=users,cn=accounts,dc=example,dc=com]; msgid = 87 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [posixGroup] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [userPassword] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [gidNumber] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaNTSecurityIdentifier] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [modifyTimestamp] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [entryUSN] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#136] Requesting attrs: [ipaExternalMember] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#136] New operation 87 timeout 6 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edcfdf740], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edcfdf740], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#136] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#136] Handling LDAP operation [87][server: [10.75.22.247:389] filter: [(null)] base: [uid=brian,cn=users,cn=accounts,dc=example,dc=com]] took [11.720] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_parse_entry] (0x0400): [RID#136] Got deref control (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: cn=admins,cn=groups,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: top (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: groupofnames (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: posixgroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipausergroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaobject (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: nestedGroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaNTGroupAttrs (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Found map for objectclass 'posixgroup' (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: objectClass (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: cn (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: admins (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: gidNumber (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 396000000 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: member (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=admin,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=brian,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: ipaUniqueID (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: ee5c762a-3df4-11e5-b75f-0014d11345ac (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: ipaNTSecurityIdentifier (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: S-1-5-21-2174803935-1024707874-457163226-512 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: modifyTimestamp (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 20260703051953Z (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: entryUSN (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 22549839 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: cn=ipausers,cn=groups,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: top (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: groupofnames (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: nestedgroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipausergroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaobject (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Found map for objectclass 'ipausergroup' (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: objectClass (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: cn (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: ipausers (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: member (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=brian,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=alice,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=brianm,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=asterisk,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=dave,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=carrie,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=tanya,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=spamd,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=cyrus,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: ipaUniqueID (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: ee8cbb0a-3df4-11e5-9012-0014d11345ac (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: modifyTimestamp (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 20220117195619Z (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: entryUSN (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 2 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: cn=parents,cn=groups,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: top (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: groupofnames (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: nestedgroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipausergroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaobject (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: posixgroup (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipantgroupattrs (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Found map for objectclass 'ipausergroup' (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: objectClass (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: cn (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: parents (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: gidNumber (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 396000011 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: member (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=brian,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: uid=alice,cn=users,cn=accounts,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: ipaUniqueID (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: d4101310-9c8d-11ef-8e59-fcaa146c4fd6 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: ipaNTSecurityIdentifier (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: S-1-5-21-2174803935-1024707874-457163226-1011 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: modifyTimestamp (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 20241106222424Z (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x2000): [RID#136] Dereferenced attribute: entryUSN (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced attribute value: 8295304 (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=35758f4c-059a-11e7-8964-001fc6c4926a,cn=hbac,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipahbacrule (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=2c4b555a-b888-11e6-8f49-0014d11345ac,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=9238e136-5101-11e7-8d91-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=4443c5d8-bd6a-11e7-b453-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=47a505c0-e215-11ea-ae77-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#136] Dereferenced DN: ipaUniqueID=a9c89108-70bc-11ed-a491-fcaa146c4fd6,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#136] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_parse_entry] (0x0400): [RID#136] All deref results from a single control parsed (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edcfdf740], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#136] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#136] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#136] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#136] Operation 87 finished (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object admins (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=admins(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=admins(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object ipausers (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=ipausers(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=ipausers(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object parents (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#136] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object admins (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x2000): [RID#136] searching sysdb with filter [(&(objectCategory=group)(member=name=admins(a)example.com,cn=groups,cn=example.com,cn=sysdb)) (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x1000): [RID#136] admins(a)example.com is a member of 0 sysdb groups (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] Looking up direct parents for group [cn=admins,cn=groups,cn=accounts,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] The group [cn=admins,cn=groups,cn=accounts,dc=example,dc=com] has 0 direct parents (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_membership_diff] (0x1000): [RID#136] The group admins(a)example.com is a direct member of 0 LDAP groups (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object ipausers (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x2000): [RID#136] searching sysdb with filter [(&(objectCategory=group)(member=name=ipausers(a)example.com,cn=groups,cn=example.com,cn=sysdb)) (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x1000): [RID#136] ipausers(a)example.com is a member of 0 sysdb groups (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] Looking up direct parents for group [cn=ipausers,cn=groups,cn=accounts,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] The group [cn=ipausers,cn=groups,cn=accounts,dc=example,dc=com] has 0 direct parents (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_membership_diff] (0x1000): [RID#136] The group ipausers(a)example.com is a direct member of 0 LDAP groups (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object parents (2026-09-24 14:50:27): [be[example.com]] [sdap_attrs_get_sid_str] (0x1000): [RID#136] No [ipaNTSecurityIdentifier] attribute. [0][Success] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_fqdn] (0x2000): [RID#136] Group has name [example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x2000): [RID#136] searching sysdb with filter [(&(objectCategory=group)(member=name=parents(a)example.com,cn=groups,cn=example.com,cn=sysdb)) (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x1000): [RID#136] parents(a)example.com is a member of 0 sysdb groups (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] Looking up direct parents for group [cn=parents,cn=groups,cn=accounts,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_direct_parents] (0x4000): [RID#136] The group [cn=parents,cn=groups,cn=accounts,dc=example,dc=com] has 0 direct parents (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_nested_get_membership_diff] (0x1000): [RID#136] The group parents(a)example.com is a direct member of 0 LDAP groups (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_store_user_memberships] (0x1000): [RID#136] The user brian(a)example.com is a direct member of 3 LDAP groups (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object admins (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object ipausers (2026-09-24 14:50:27): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#136] Processing object parents (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x2000): [RID#136] searching sysdb with filter [(&(objectCategory=group)(member=name=brian(a)example.com,cn=users,cn=example.com,cn=sysdb)) (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=admins(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [merge_msg_ts_attrs] (0x2000): [RID#136] No such DN in the timestamp cache: name=ipausers(a)example.com,cn=groups,cn=example.com,cn=sysdb (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#136] TS cache doesn't contain this DN, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_get_direct_parents_ex] (0x1000): [RID#136] brian(a)example.com is a member of 3 sysdb groups (2026-09-24 14:50:27): [be[example.com]] [sdap_initgr_store_user_memberships] (0x2000): [RID#136] Updating memberships for brian(a)example.com (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_done] (0x4000): [RID#136] Initgroups done (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_done] (0x0400): [RID#136] Primary group already cached, nothing to do. (2026-09-24 14:50:27): [be[example.com]] [sdap_get_initgr_done] (0x4000): [RID#136] No need to check for domain local group memberships. (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_destroy] (0x4000): [RID#136] releasing operation connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_done] (0x4000): [RID#136] releasing operation connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_idle] (0x4000): [RID#136] Marking connection as idle (2026-09-24 14:50:27): [be[example.com]] [ipa_id_get_account_info_post_proc_step] (0x0020): [RID#136] Cannot find a UUID. (2026-09-24 14:50:27): [be[example.com]] [ipa_id_get_account_info_orig_done] (0x0040): [RID#136] ipa_id_get_account_info_post_proc_step failed. (2026-09-24 14:50:27): [be[example.com]] [dp_reply_std_set] (0x0080): [RID#136] DP Error is OK on failed request? (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x0400): [RID#136] DP Request [Initgroups #136]: Request handler finished [0]: Success (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x20000): [RID#136] DP Request [Initgroups #136]: Handling request took [25.704] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [_dp_req_recv] (0x0400): [RID#136] DP Request [Initgroups #136]: Receiving request data. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#136] DP Request [Initgroups #136]: Request removed. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#136] Number of active DP request: 0 (2026-09-24 14:50:27): [be[example.com]] [dp_get_account_info_initgroups_resolv_done] (0x0400): [RID#136] Ordering NSS responder to update memory cache (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[(nil)], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list ==> /var/log/sssd/sssd_nss.log <== (2026-09-24 14:50:27): [nss] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [nss] [sbus_method_handler] (0x2000): Received D-Bus method sssd.nss.MemoryCache.UpdateInitgroups on /sssd from sssd.domain_example_2ecom (2026-09-24 14:50:27): [nss] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.domain_example_2ecom] (2026-09-24 14:50:27): [nss] [sss_nss_memorycache_update_initgroups] (0x1000): Updating initgroups memory cache of [brian@example.com@example.com] (2026-09-24 14:50:27): [nss] [sbus_issue_request_done] (0x0400): sssd.nss.MemoryCache.UpdateInitgroups on /sssd from sssd.domain_example_2ecom: Success ==> /var/log/sssd/sssd_example.com.log <== (2026-09-24 14:50:27): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [be[example.com]] [dp_req_reply_std] (0x1000): [RID#136] DP Request [Initgroups #136]: Returning [Success]: 0,22,Success (2026-09-24 14:50:27): [be[example.com]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo on /sssd from sssd.pam: Success (2026-09-24 14:50:27): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2026-09-24 14:50:27): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.pamHandler on /sssd from sssd.pam (2026-09-24 14:50:27): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.pam] (2026-09-24 14:50:27): [be[example.com]] [dp_pam_handler_send] (0x0100): Got request with the following data (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): domain: example.com (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): user: brian(a)example.com (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): service: sshd (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): tty: ssh (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): ruser: (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): rhost: 2001:123:4567:0:8ce5:e3c5:6b35:d594 (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): authtok type: 0 (No authentication token available) (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available) (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): priv: 1 (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): cli_pid: 943432 (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): child_pid: 0 (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): logon name: not set (2026-09-24 14:50:27): [be[example.com]] [pam_print_data] (0x0100): flags: 0 (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#137] DP Request [PAM Account #137]: REQ_TRACE: New request. [sssd.pam CID #15] Flags [0000]. (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#137] Number of active DP request: 1 (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#137] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sdap_access_send] (0x0400): [RID#137] Performing access check for user [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired_rhds] (0x0400): [RID#137] Performing RHDS access check for user [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired_rhds] (0x4000): [RID#137] Account for user [brian(a)example.com] is not locked. (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired] (0x0400): [RID#137] IPA access control succeeded, checking AD access control (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired_ad] (0x0400): [RID#137] Performing AD access check for user [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired_ad] (0x4000): [RID#137] User account control for user [brian(a)example.com] is [0]. (2026-09-24 14:50:27): [be[example.com]] [sdap_account_expired_ad] (0x4000): [RID#137] Expiration time for user [brian(a)example.com] is [0]. (2026-09-24 14:50:27): [be[example.com]] [ipa_fetch_hbac_send] (0x4000): [RID#137] Connection status is [online]. (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#137] reusing cached connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#137] Marking connection as not idle (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#137] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#137] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(objectClass=ipaHost)(|(fqdn=pc.example.com)(serverHostname=pc.example.com)))] base: [cn=accounts,dc=example,dc=com]; msgid = 88 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [fqdn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [serverHostname] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipaSshPubKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#137] New operation 88 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#137] Handling LDAP operation [88][server: [10.75.22.247:389] filter: [(&(objectClass=ipaHost)(|(fqdn=pc.example.com)(serverHostname=pc.example.com)))] base: [cn=accounts,dc=example,dc=com]] took [1.091] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [fqdn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [serverHostname] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipaSshPubKey] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#137] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#137] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#137] Operation 88 finished (2026-09-24 14:50:27): [be[example.com]] [sdap_has_deref_support_ex] (0x0400): [RID#137] The server supports deref method OpenLDAP (2026-09-24 14:50:27): [be[example.com]] [sdap_deref_search_send] (0x2000): [RID#137] Server supports OpenLDAP deref (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_search_send] (0x0400): [RID#137] Dereferencing entry [fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com] using OpenLDAP deref (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#137] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_send] (0x0400): [RID#137] WARNING: Disabling paging because scope is set to base. (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#137] ldap_search_ext called: server: [10.75.22.247:389] filter: [(null)] base: [fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com]; msgid = 89 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#137] New operation 89 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#137] Handling LDAP operation [89][server: [10.75.22.247:389] filter: [(null)] base: [fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com]] took [8.559] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_parse_entry] (0x0400): [RID#137] Got deref control (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x1000): [RID#137] Dereferenced DN: ipaUniqueID=47a505c0-e215-11ea-ae77-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#137] Dereferenced objectClass value: ipaassociation (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_deref] (0x4000): [RID#137] Dereferenced objectClass value: ipasudorule (2026-09-24 14:50:27): [be[example.com]] [sdap_x_deref_parse_entry] (0x0400): [RID#137] All deref results from a single control parsed (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#137] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#137] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#137] Operation 89 finished (2026-09-24 14:50:27): [be[example.com]] [ipa_hostgroup_info_done] (0x0200): [RID#137] No host groups were dereferenced (2026-09-24 14:50:27): [be[example.com]] [ipa_hbac_service_info_next] (0x0400): [RID#137] Sending request for next search base: [cn=hbac,dc=example,dc=com][2][(objectClass=ipaHBACService)] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#137] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#137] ldap_search_ext called: server: [10.75.22.247:389] filter: [(objectClass=ipaHBACService)] base: [cn=hbac,dc=example,dc=com]; msgid = 90 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#137] New operation 90 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#137] Handling LDAP operation [90][server: [10.75.22.247:389] filter: [(objectClass=ipaHBACService)] base: [cn=hbac,dc=example,dc=com]] took [2.424] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=sshd,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=ftp,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=su,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=login,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=su-l,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=sudo,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=sudo-i,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=gdm,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=gdm-password,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=kdm,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=crond,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=vsftpd,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=pure-ftpd,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=proftpd,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=gssftp,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=imap,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=smtp,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=systemd-user,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=http,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=squid,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=sieve,cn=hbacservices,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#137] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#137] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#137] Operation 90 finished (2026-09-24 14:50:27): [be[example.com]] [ipa_hbac_servicegroup_info_next] (0x0400): [RID#137] Sending request for next search base: [cn=hbac,dc=example,dc=com][2][(objectClass=ipaHBACServiceGroup)] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#137] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#137] ldap_search_ext called: server: [10.75.22.247:389] filter: [(objectClass=ipaHBACServiceGroup)] base: [cn=hbac,dc=example,dc=com]; msgid = 91 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberOf] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#137] New operation 91 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#137] Handling LDAP operation [91][server: [10.75.22.247:389] filter: [(objectClass=ipaHBACServiceGroup)] base: [cn=hbac,dc=example,dc=com]] took [0.699] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=Sudo,cn=hbacservicegroups,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=ftp,cn=hbacservicegroups,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [cn=gdm-login,cn=hbacservicegroups,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [member] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede0079d0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#137] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#137] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#137] Operation 91 finished (2026-09-24 14:50:27): [be[example.com]] [ipa_hbac_rule_info_next] (0x0400): [RID#137] Sending request for next search base: [cn=hbac,dc=example,dc=com][2][(&(objectclass=ipaHBACRule)(ipaenabledflag=TRUE)(accessRuleType=allow)(|(hostCategory=all)(memberHost=fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com)(memberHost=ipaUniqueID=47a505c0-e215-11ea-ae77-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com)))] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#137] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#137] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(objectclass=ipaHBACRule)(ipaenabledflag=TRUE)(accessRuleType=allow)(|(hostCategory=all)(memberHost=fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com)(memberHost=ipaUniqueID=47a505c0-e215-11ea-ae77-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com)))] base: [cn=hbac,dc=example,dc=com]; msgid = 92 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [ipaenabledflag] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [accessRuleType] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberUser] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [userCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberService] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [serviceCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [sourceHost] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [sourceHostCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [externalHost] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [memberHost] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#137] Requesting attrs: [hostCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#137] New operation 92 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede002950], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#137] Handling LDAP operation [92][server: [10.75.22.247:389] filter: [(&(objectclass=ipaHBACRule)(ipaenabledflag=TRUE)(accessRuleType=allow)(|(hostCategory=all)(memberHost=fqdn=pc.example.com,cn=computers,cn=accounts,dc=example,dc=com)(memberHost=ipaUniqueID=47a505c0-e215-11ea-ae77-001fc6c4926a,cn=sudorules,cn=sudo,dc=example,dc=com)))] base: [cn=hbac,dc=example,dc=com]] took [0.665] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#137] OriginalDN: [ipaUniqueID=35758f4c-059a-11e7-8964-001fc6c4926a,cn=hbac,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [objectclass] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipauniqueid] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [ipaenabledflag] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [accessRuleType] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [memberUser] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [serviceCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_range] (0x4000): [RID#137] No sub-attributes for [hostCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555ede002950], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#137] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#137] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#137] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#137] Operation 92 finished (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_done] (0x4000): [RID#137] releasing operation connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_idle] (0x4000): [RID#137] Marking connection as idle (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Found [1] items to delete. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=pc.example.com,cn=hbac_hosts,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [pc.example.com] (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Found [21] items to delete. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=kdm,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=squid,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=login,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=smtp,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=imap,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=pure-ftpd,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=vsftpd,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=proftpd,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=systemd-user,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=sshd,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=crond,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=sudo,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=su,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=sudo-i,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=gdm,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=ftp,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=gssftp,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=http,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=gdm-password,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=su-l,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=sieve,cn=hbac_services,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [sshd]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [ftp]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [su]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [login]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [su-l]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [sudo]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [sudo-i]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [gdm]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [gdm-password]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [kdm]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [crond]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [vsftpd]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [pure-ftpd]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [proftpd]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [gssftp]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [imap]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [smtp]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [systemd-user]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [http]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [squid]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [sieve]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Found [3] items to delete. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=gdm-login,cn=hbac_servicegroups,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=Sudo,cn=hbac_servicegroups,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=ftp,cn=hbac_servicegroups,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [Sudo]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [ftp]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [gdm-login]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Found [1] items to delete. (2026-09-24 14:50:27): [be[example.com]] [sysdb_delete_recursive_with_filter] (0x4000): [RID#137] Trying to delete [name=35758f4c-059a-11e7-8964-001fc6c4926a,cn=hbac_rules,cn=custom,cn=example.com,cn=sysdb]. (2026-09-24 14:50:27): [be[example.com]] [ipa_common_save_list] (0x4000): [RID#137] Object name: [35758f4c-059a-11e7-8964-001fc6c4926a]. (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [hbac_attrs_to_rule] (0x1000): [RID#137] Processing rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [hbac_user_attrs_to_rule] (0x1000): [RID#137] Processing users for rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [sysdb_cache_search_users] (0x2000): [RID#137] Search users with filter: (&(objectCategory=user)(originalDN=uid=brian,cn=users,cn=accounts,dc=example,dc=com)) (2026-09-24 14:50:27): [be[example.com]] [hbac_user_attrs_to_rule] (0x2000): [RID#137] Added user [brian(a)example.com] to rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [hbac_service_attrs_to_rule] (0x1000): [RID#137] Processing PAM services for rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [hbac_get_category] (0x0200): [RID#137] Category is set to 'all'. (2026-09-24 14:50:27): [be[example.com]] [hbac_thost_attrs_to_rule] (0x1000): [RID#137] Processing target hosts for rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [hbac_get_category] (0x0200): [RID#137] Category is set to 'all'. (2026-09-24 14:50:27): [be[example.com]] [hbac_shost_attrs_to_rule] (0x0400): [RID#137] Processing source hosts for rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [hbac_shost_attrs_to_rule] (0x2000): [RID#137] Source hosts disabled, setting ALL (2026-09-24 14:50:27): [be[example.com]] [hbac_eval_user_element] (0x1000): [RID#137] [3] groups for [brian(a)example.com] (2026-09-24 14:50:27): [be[example.com]] [hbac_eval_user_element] (0x1000): [RID#137] Added group [admins] for user [brian] (2026-09-24 14:50:27): [be[example.com]] [hbac_eval_user_element] (0x1000): [RID#137] Added group [parents] for user [brian] (2026-09-24 14:50:27): [be[example.com]] [hbac_eval_user_element] (0x1000): [RID#137] Added group [ipausers] for user [brian] (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#137] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [hbac_evaluate] (0x0100): [RID#137] [< hbac_evaluate() (2026-09-24 14:50:27): [be[example.com]] [hbac_req_debug_print] (0x2000): [RID#137] REQUEST: (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] service [sshd] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] service_group (none) (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] user [brian] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] user_group: (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] [admins] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] [parents] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] [ipausers] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] targethost [pc.example.com] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] targethost_group (none) (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] srchost [2001:123:4567:0:8ce5:e3c5:6b35:d594] (2026-09-24 14:50:27): [be[example.com]] [hbac_request_element_debug_print] (0x2000): [RID#137] srchost_group (none) (2026-09-24 14:50:27): [be[example.com]] [hbac_req_debug_print] (0x2000): [RID#137] request time 2026-09-24 14:50:27 (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_debug_print] (0x2000): [RID#137] RULE [brian_all_hosts] [ENABLED]: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_debug_print] (0x2000): [RID#137] services: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] category [0x1] [ALL] (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_debug_print] (0x2000): [RID#137] users: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] category [0] [NONE] (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] users_names: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] [brian] (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] users_groups (none) (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_debug_print] (0x2000): [RID#137] targethosts: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] category [0x1] [ALL] (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_debug_print] (0x2000): [RID#137] srchosts: (2026-09-24 14:50:27): [be[example.com]] [hbac_rule_element_debug_print] (0x2000): [RID#137] category [0x1] [ALL] (2026-09-24 14:50:27): [be[example.com]] [hbac_evaluate] (0x0100): [RID#137] ALLOWED by rule [brian_all_hosts]. (2026-09-24 14:50:27): [be[example.com]] [hbac_evaluate] (0x0100): [RID#137] hbac_evaluate() >] (2026-09-24 14:50:27): [be[example.com]] [ipa_hbac_evaluate_rules] (0x0080): [RID#137] Access granted by HBAC rule [brian_all_hosts] (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x0400): [RID#137] DP Request [PAM Account #137]: Request handler finished [0]: Success (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x20000): [RID#137] DP Request [PAM Account #137]: Handling request took [57.169] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [_dp_req_recv] (0x0400): [RID#137] DP Request [PAM Account #137]: Receiving request data. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#137] DP Request [PAM Account #137]: Request removed. (2026-09-24 14:50:27): [be[example.com]] [dp_req_destructor] (0x0400): [RID#137] Number of active DP request: 0 (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#138] DP Request [PAM SELinux #138]: REQ_TRACE: New request. [sssd.pam CID #15] Flags [0000]. (2026-09-24 14:50:27): [be[example.com]] [dp_attach_req] (0x0400): [RID#138] Number of active DP request: 1 (2026-09-24 14:50:27): [be[example.com]] [sss_domain_get_state] (0x2000): [RID#138] Domain example.com is Active (2026-09-24 14:50:27): [be[example.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#138] TS cache doesn't handle this DN type, skipping (2026-09-24 14:50:27): [be[example.com]] [ipa_get_selinux_send] (0x0400): [RID#138] Retrieving SELinux user mapping (2026-09-24 14:50:27): [be[example.com]] [ipa_get_selinux_send] (0x2000): [RID#138] Connection status is [online]. (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#138] reusing cached connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#138] Marking connection as not idle (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#138] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#138] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(cn=ipaConfig)(objectClass=ipaGuiConfig))] base: [cn=etc,dc=example,dc=com]; msgid = 93 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [ipaSELinuxUserMapDefault] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [ipaSELinuxUserMapOrder] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#138] New operation 93 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0002c0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0002c0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#138] Message type: [LDAP_RES_SEARCH_ENTRY] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#138] Handling LDAP operation [93][server: [10.75.22.247:389] filter: [(&(cn=ipaConfig)(objectClass=ipaGuiConfig))] base: [cn=etc,dc=example,dc=com]] took [0.737] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#138] OriginalDN: [cn=ipaConfig,cn=etc,dc=example,dc=com]. (2026-09-24 14:50:27): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#138] Entry has no attributes [0(Success)]!? (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0002c0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#138] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#138] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#138] Operation 93 finished (2026-09-24 14:50:27): [be[example.com]] [ipa_selinux_get_maps_next] (0x0400): [RID#138] Trying to fetch SELinux maps with following parameters: [2][(&(objectclass=ipaselinuxusermap)(ipaEnabledFlag=TRUE))][cn=selinux,dc=example,dc=com] (2026-09-24 14:50:27): [be[example.com]] [sdap_print_server] (0x2000): [RID#138] Searching 10.75.22.247:389 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#138] ldap_search_ext called: server: [10.75.22.247:389] filter: [(&(objectclass=ipaselinuxusermap)(ipaEnabledFlag=TRUE))] base: [cn=selinux,dc=example,dc=com]; msgid = 94 (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [objectClass] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [cn] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [memberUser] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [memberHost] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [seeAlso] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [ipaSELinuxUser] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [ipaEnabledFlag] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [userCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [hostCategory] (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_ext_step] (0x4000): [RID#138] Requesting attrs: [ipaUniqueID] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_add] (0x2000): [RID#138] New operation 94 timeout 0 (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0002c0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2026-09-24 14:50:27): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x555ede0074f0], connected[1], ops[0x555edd0002c0], ldap[0x555edcfbc3b0] (2026-09-24 14:50:27): [be[example.com]] [sdap_process_message] (0x4000): [RID#138] Message type: [LDAP_RES_SEARCH_RESULT] (2026-09-24 14:50:27): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#138] Handling LDAP operation [94][server: [10.75.22.247:389] filter: [(&(objectclass=ipaselinuxusermap)(ipaEnabledFlag=TRUE))] base: [cn=selinux,dc=example,dc=com]] took [0.329] milliseconds. (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#138] Search result: Success(0), no errmsg set (2026-09-24 14:50:27): [be[example.com]] [sdap_get_generic_op_finished] (0x2000): [RID#138] Total count [0] (2026-09-24 14:50:27): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#138] Operation 94 finished (2026-09-24 14:50:27): [be[example.com]] [ipa_selinux_get_maps_done] (0x0400): [RID#138] No SELinux user maps found! (2026-09-24 14:50:27): [be[example.com]] [sdap_id_op_destroy] (0x4000): [RID#138] releasing operation connection (2026-09-24 14:50:27): [be[example.com]] [sdap_id_conn_data_idle] (0x4000): [RID#138] Marking connection as idle (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x0400): [RID#138] DP Request [PAM SELinux #138]: Request handler finished [0]: Success (2026-09-24 14:50:27): [be[example.com]] [dp_req_done] (0x20000): [RID#138] DP Request [PAM SELinux #138]: Handling request took [1.573] mil Is there enough info in there to determine what is going wrong? If not I am (more than!) happy to provide whatever additional information might be necessary. I really need to get this back functional so that I can take another stab at getting off of EL8. Cheers, b.

4 19

Trust between FreeIPA and Keycloak
by Francis Augusto Medeiros-Logeay 08 Oct '26

08 Oct '26

Hi, I developed a Keycloak extension (Keycloak PSSO extension) so that users of managed macOS machines get SSO. The framework used - Platform Single Sign-on - also allows returning kerberos tickets. But I'm not sure how Keycloak could programmatically return kerberos tickets for a user without the password. Some of the pPlatform SSO flows do not involve using passwords. The idea I had first was to use my extension with some keytab with permissions to request kerberos tickets on behalf of other users. But has FreeIPA support for OAuth2 tokens, so that I could simply exchange an OAuth2 token to a kerberos tickets? This would be easier since I already control token issuing on the keycloak side. Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 10

[ANNOUNCE] google2ipa: sync Google Workspace users and groups into FreeIPA
by Maksym Hrytsaienko 29 Sep '26

29 Sep '26

Hi all, I'd like to share a small open-source tool I've been running in production: google2ipa, which keeps FreeIPA in sync with Google Workspace as the source of truth. https://github.com/neverlless/google2ipa The problem: Google Cloud Directory Sync only goes LDAP -> Google, so there was no maintained way to provision FreeIPA from Google Workspace, and offboarding (locking Linux/VPN/Kerberos/sudo access for people who left) depended on someone remembering to do it. What it does on each run: - creates new Google users in FreeIPA with an IPA-generated one-time password (optionally mailed to the user) - maps Google groups (including nested ones) to IPA groups - locks users who left Google via krbPrincipalExpiration, and deletes them with --preserve after a configurable delay (restorable with user-undel) - only touches users in a dedicated "managed" group; existing users are left alone - has a safety brake that refuses to mass-disable if Google returns a suspiciously small list, plus --dry-run to review the plan It uses the JSON-RPC API with a least-privilege role (User/Group/Stage User Administrators plus one custom permission on krbPrincipalExpiration). No schema changes and no LDAP access. It's a single Go binary / signed container, tested against FreeIPA 4.12, Apache-2.0. I'd really appreciate feedback, especially on the privilege setup: is there a cleaner way to allow locking users than a custom write permission on krbPrincipalExpiration? Bug reports and ideas are welcome on GitHub or here. I've also opened a PR to list it on the HowTos page: https://github.com/freeipa/freeipa.github.io/pull/73 Thanks, Maksym

1 0

Samba on clients - NT_STATUS_NO_LOGON_SERVERS - is ipa-adtrust-install required?
by listy 17 Sep '26

17 Sep '26

Hi guys. Hoping somebody knows - before I start fiddling - I think it was not needed but I did not use Samaba in a long time. On ipa client's samba I get: ... [2026/09/16 17:30:06.023475, 1, traceid=1] ../../source3/libads/ldap.c:836(ads_find_dc) ads_find_dc: name resolution for realm 'MINE.PRIV' (domain 'MINE') failed: NT_STATUS_NO_LOGON_SERVERS ... I cannot authenticate my users - is this because ipa masters need _ipa-adtrust-install_ deployed? (even if there is no Win AD actually) many thanks, L.

2 5

does IPA client checks ntp?
by listy 16 Sep '26

16 Sep '26

Hi guys. Having a client set to use _ntp_ at install time - I wonder if IPA checks & override what user do to time sync client/settings? I wonder for "something" enables back my chrony/timedate after I stopped/disabled it. thanks, L.

2 4

WebUI login broken realm-wide ("Login failed due to an unknown reason") — anonymous PKINIT kinit -n fails with Generic error / UNKNOWN_REASON, root cause not found
by adam panayis 14 Sep '26

14 Sep '26

Hi all, We've been chasing a WebUI login failure for several days and have exhausted our own diagnostic options. Posting the full picture in case anyone recognizes this or can point us at something we've missed. Environment: - 3-server multi-master topology (2x RHEL8/Oracle Linux 8 replicas on ipa-server-4.9.13-21.0.1.module+el8.10.0, 1x older replica on ipa-server-4.6.8-5.el7_9.12, since removed from topology — see below) - Realm: FX.LAN Symptom: WebUI login fails on all replicas with "Login failed due to an unknown reason." Root cause traces to ipaserver/rpcserver.py's attempt_kinit/kinit_armor calling kinit -n (anonymous PKINIT armor) as a subprocess, which fails: kinit: Generic error (see e-text) while getting initial credentials krb5kdc.log shows: AS_REQ ... UNKNOWN_REASON: WELLKNOWN/ANONYMOUS(a)FX.LAN for krbtgt/FX.LAN(a)FX.LAN, Generic error (see e-text) Packet capture confirms the KDC rejects the anonymous AS-REQ on the very first round trip, before any PKINIT certificate exchange begins. Real password-based kinit, SSH, and the ipa CLI all work perfectly, on every server, throughout. Only this specific anonymous-armor step (used by both the WebUI's password login form and its Kerberos/SPNEGO SSO login path — we tested both) is affected. What we've ruled out, with evidence: - PKINIT certs/EKUs/subject — a real but unrelated cert-subject bug was found and fixed along the way; confirmed unrelated via the packet capture above. - LDAP data/replication — WELLKNOWN/ANONYMOUS entry unmodified since 2017; every LDAP search for it during actual failures returns err=0 success (confirmed via 389-DS access logs correlated to the exact failure timestamps). - ipa-kdb key-stripping (the class of bug in Pagure #9065) — kadmin.local getprinc WELLKNOWN/ANONYMOUS confirms 2 valid keys present, identical on all servers. - Local 389-DS index corruption (-30993) on one server — real, but confirmed unrelated (wrong day, and other clean-database servers still fail identically). - Topology consistency — ipa topologysuffix-verify domain/ca both clean. - A replica (idmserver-ha) had been left mid-removal (DNS SRV records stripped, server-del never completed) around the time this started — we completed the removal cleanly, no change to the symptom. This rules out what had been our leading hypothesis. - SPAKE preauth config — production kdc.conf correctly configured. One static-analysis lead, unconfirmed: in MIT krb5's do_as_req.c, UNKNOWN_REASON is a generic fallback (if (errcode != 0 && state->status == NULL) state->status = "UNKNOWN_REASON";). The anonymous-request handling block contains one status-less error path: errcode = krb5_copy_principal(context, krb5_anonymous_principal(), &state->request->client); if (errcode) goto errout; This matches the anonymous-only symptom, but it's a pure in-memory copy of a compile-time constant with no external dependency — we can't explain why it would suddenly start failing, and we haven't been able to confirm live whether this is even the actual branch being hit. Where we're stuck: we can't get a live gdb trace to confirm/deny the above — our installed krb5-server-1.18.2-34.0.1.el8_10 has an Oracle-specific patch revision (.0.1) with no matching debuginfo available anywhere we could find (checked Oracle's own debuginfo repo and cross-referenced AlmaLinux, which ships a different build 1.18.2-34.el8_10 without that suffix — not a build-id match). Has anyone seen this exact signature before, or have suggestions for getting further without matching debug symbols? Happy to provide more logs/detail on request. Thanks,

2 1

Configuration between IPA and AD question
by Ty zang 11 Sep '26

11 Sep '26

Hey all, I have been fighting this IPA/AD trust configuration for almost 3 weeks now and I am a bit stumped. Technically, the trust is working but because our AD is so large and complex, I am seeing a lot of latency which (i believe) is breaking authentication to my servers. Here is a little background: AD is layed out: +----------------------------------------+ | ACTIVE DIRECTORY FOREST | | W.NET | | (Forest Root Domain) | +----------------------------------------+ | +-------------------------+--------------------------------------+ | | | | | +-----------+ +-----------+ +-----------+ +-----------+ +-----------+ | S.W.NET | | B.W.NET | | H.W.NET | | R.W.NET | | V.W.NET | | (Users & | | (Users & | | (Ignored/ | | (Ignored/ | | (Ignored/ | | Groups) | | Groups) | | Disabled) | | Disabled) | | Disabled) | +-----------+ +-----------+ +-----------+ +-----------+ +-----------+ I only care about S and B child domains. I am not sure how I can tell SSSD/IPA to ignore the other H, R, and V domains and only look up uses in S or B. The issues that I am seeing are: 1. Running ID on a user in S or B takes ~ 1m+ to return results. I believe its returning a LOT of groups too which might be a problem. I tried making SSSD changes regarding ignore_group_members and it seems to speed things up a bit, but then getent group does not work. 2. AD Users cannot authenticate, getting System Error 4. I suspect its latency or a configuration issues. So I guess my questions are these: 1. Is it possible to establish a trust directly with S and B without trusting the parent (W)? It seems to fail saying I need to trust a forest. 2. Is it possible to "disable" the other domains to maybe speed things up? 3. Anything in krb5 or sssd that I need to add/configure to help with performance? Thanks all!

1 2

ns-slapd uses 100% CPU, replications crash source servers, everything is terrible, send help
by Nerd Invert 10 Sep '26

10 Sep '26

I hardly know where to start describing this. I'm having tons of trouble adding a simple fourth replica to my setup, something I've done effortlessly in the past. The setup: Rocky Linux 8.10 all around, FreeIPA 4.9.13. Three servers: idm0, idm1 and idm2. I wish to add idm3. Very small database, maybe 50 users and 200 hosts. Has been going for 7-8 years so many hosts have a couple of expired certificates, but again, very small. I did an "ipa backup" recently and the resulting file was 80MB. I also checked one of my old logs, and then the replication took literally 10 seconds. Problem 1: replication doesn't work. It takes forever (hours) then either crashes or crashes the source server with an OOM killer fault. It should be noted that some of the source servers had very little memory, 4GB and the same for swap, but I have since upgraded. My install procedure for idm3 is: Turn off firewall on idm3 completely, to take that out of the equation. ipa-client-install --principal admin --no-ntp --no-nisdomain --force-join ipa-replica-install --debug --principal admin --setup-ca --setup-dns --forwarder=8.8.8.8 --forwarder=8.8.4.4 It makes it to step 26 where it's "replicating" and sits there forever. Problem 2: ns-slapd consumes 100% CPU for days on end, on some of the existing servers. The pattern of this behavior escapes me. It should be noted that I might have created an "idm3" host and tried to promote it to replica years ago. I deleted the host, but perhaps some replication agreements are lingering? Input on which log files I should follow and what I should try greatly appreciated.

5 4

OID management
by Olivier G 07 Sep '26

07 Sep '26

Hi everybody, I have read the documentation and some answers of this mailing list but things are stil unclear. Can you confirm (or not) my understanding of FreeIPA OIDs management: * FreeIPA does not allow to add a specific PEN number to its own root CA. * FreeIPA (as rootCA) allows to add PEN number to its SubCA thanks to certprofile (which are propagated to the final certificate). * FreeIPA used as SubCA keeps and manage specific PEN number 'given' by the root CA. Thanks in advance for reading, Olivier

2 5

FreeIPA 4.13.4
by Antonio Torres 07 Sep '26

07 Sep '26

The FreeIPA team would like to announce the FreeIPA 4.13.4 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. Full release notes are available at: https://www.freeipa.org/release-notes/4-13-4.html

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2026