Hi Greg Thanks for the quick response I have checked the output of ldapsearch The output of the ldapsearch command for the user -bash-3.2# /usr/bin/ldapsearch -h server.com -p 389 -x -b ou=People,o=sample "(&(uid=nitinst)(objectclass=posixAccount))" objectclass # extended LDIF # # LDAPv3 # base <ou=People,o=sample> with scope subtree # filter: (&(uid=nitinst)(objectclass=posixAccount)) # requesting: objectclass # # nitinst, People, sample dn: uid=nitinst,ou=People,o=sample objectclass: posixaccount objectclass: shadowaccount objectclass: account objectclass: top # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 -bash-3.2# Thanks And Regards Nitesh On Fri, Nov 11, 2011 at 12:57 PM, <Greg.Lehmann(a)csiro.au&gt; wrote: > I have no experience with straight LDAP, but do with Active directory > LDAP. Sorting out the problems does have some overlap. Have you used the > ldapsearch command to make sure your LDAP server is returning what you > would expect? E.g.**** > > ** ** > > ldapsearch -H ldap://server.domain.com -b "dc=domain,dc=com" -D " > browseid(a)domain.com&quot; -W -L "(&(sAMAccountNAME=fred)(objectClass=user))"** > ** > > ** ** > > ** ** > > *From:* sssd-devel-bounces(a)lists.fedorahosted.org [mailto: > sssd-devel-bounces(a)lists.fedorahosted.org] *On Behalf Of *Nitesh Mehare > *Sent:* Friday, 11 November 2011 4:33 PM > *To:* sssd-devel(a)lists.fedorahosted.org > *Subject:* [SSSD] SSSD Configuration issue**** > > ** ** > > Hello > > I'm configuring SSSD for the first time.I'm trying to setup the machine > to authenticate using ldap server using sssd.The machine configuration is > as follows > > bash-3.2# uname -a > Linux bagira.in.ibm.com 2.6.18-238.el5 #1 SMP Sun Dec 19 14:22:44 EST > 2010 x86_64 x86_64 x86_64 GNU/Linux > bash-3.2# cat /etc/issue > Red Hat Enterprise Linux Server release 5.6 (Tikanga) > Kernel \r on an \m > > bash-3.2# > > bash-3.2# rpm -qa |grep sssd > sssd-1.2.1-39.el5 > sssd-client-1.2.1-39.el5 > bash-3.2# > > > *I have modified sssd.conf file * > > bash-3.2# cat /etc/sssd/sssd.conf > [sssd] > config_file_version = 2 > > # Number of times services should attempt to reconnect in the > # event of a crash or restart before they give up > reconnection_retries = 3 > > # If a back end is particularly slow you can raise this timeout here > sbus_timeout = 30 > services = nss, pam > > # SSSD will not start if you do not configure any domains. > # Add new domain configurations as [domain/<NAME>] sections, and > # then add the list of domains (in the order you want them to be > # queried) to the "domains" attribute below and uncomment it. > domains = LDAP > > [nss] > # The following prevents SSSD from searching for the root user/group in > # all domains (you can add here a comma-separated list of system accounts > that > # are always going to be /etc/passwd users, or that you want to filter > out). > filter_groups = root > filter_users = root > reconnection_retries = 3 > > # The entry_cache_timeout indicates the number of seconds to retain an > # entry in cache before it is considered stale and must block to refresh. > # The entry_cache_nowait_timeout indicates the number of seconds to > # wait before updating the cache out-of-band. (NSS requests will still > # be returned from cache until the full entry_cache_timeout). Setting this > # value to 0 turns this feature off (default). > ; entry_cache_timeout = 600 > ; entry_cache_nowait_timeout = 300 > > [pam] > reconnection_retries = 3 > > # Example domain configurations > # Note that enabling enumeration in the following configurations will > have a > # moderate performance impact while enumerations are actually running, and > # may increase the time necessary to detect network disconnection. > # Consequently, the default value for enumeration is FALSE. > # Refer to the sssd.conf man page for full details. > > # Example LOCAL domain that stores all users natively in the SSSD internal > # directory. These local users and groups are not visible in /etc/passwd; > it > # now contains only root and system accounts. > ; [domain/LOCAL] > ; description = LOCAL Users domain > ; id_provider = local > ; enumerate = true > ; min_id = 500 > ; max_id = 999 > > # Example native LDAP domain > # ldap_schema can be set to "rfc2307", which uses the "memberuid" > attribute > # for group membership, or to "rfc2307bis", which uses the "member" > attribute > # to denote group membership. Changes to this setting affect only how we > # determine the groups a user belongs to and will have no negative effect > on > # data about the user itself. If you do not know this value, ask an > # administrator. > [domain/LDAP] > debug_level = 9 > id_provider = ldap > auth_provider = ldap > ldap_schema = rfc2307 > access_provider = ldap > ldap_access_filter = memberOf=cn=idsldap,ou=People,o=sample > ldap_uri = ldap://lbullet.in.ibm.com > ldap_search_base = ou=People,o=sample > ldap_tls_reqcert = never > cache_credentials = false > enumerate = False > > # Example LDAP domain where the LDAP server is an Active Directory server. > > ; [domain/AD] > ; description = LDAP domain with AD server > ; enumerate = false > ; min_id = 1000 > ; > ; id_provider = ldap > ; auth_provider = ldap > ; ldap_uri = ldap://your.ad.server.com > ; ldap_schema = rfc2307bis > ; ldap_user_search_base = cn=users,dc=example,dc=com > ; ldap_group_search_base = cn=users,dc=example,dc=com > ; ldap_default_bind_dn = cn=Administrator,cn=Users,dc=example,dc=com > ; ldap_default_authtok_type = password > ; ldap_default_authtok = YOUR_PASSWORD > ; ldap_user_object_class = person > ; ldap_user_name = msSFU30Name > ; ldap_user_uid_number = msSFU30UidNumber > ; ldap_user_gid_number = msSFU30GidNumber > ; ldap_user_home_directory = msSFU30HomeDirectory > ; ldap_user_shell = msSFU30LoginShell > ; ldap_user_principal = userPrincipalName > ; ldap_group_object_class = group > ; ldap_group_name = msSFU30Name > ; ldap_group_gid_number = msSFU30GidNumber > ; ldap_force_upper_case_realm = True > bash-3.2# > > > *The system-auth file looks like this* > > bash-3.2# cat /etc/pam.d/system-auth > #%PAM-1.0 > # This file is auto-generated. > # User changes will be destroyed the next time authconfig is run. > auth required pam_env.so > auth sufficient pam_unix.so nullok try_first_pass > auth requisite pam_succeed_if.so uid >= 500 quiet > auth sufficient /lib64/security/pam_sss.so use_first_pass > auth required pam_deny.so > > account required pam_unix.so > account sufficient pam_localuser.so > account sufficient pam_succeed_if.so uid < 500 quiet > account [default=bad success=ok user_unknown=ignore] > /lib64/security/pam_sss.so > account required pam_permit.so > > password requisite pam_cracklib.so try_first_pass retry=3 type= > password sufficient pam_unix.so md5 shadow nullok try_first_pass > use_authtok > password sufficient /lib64/security/pam_sss.so use_authtok > password required pam_deny.so > > session required pam_mkhomedir.so umask=0022 skel=/etc/skel/ > session optional pam_keyinit.so revoke > session required pam_limits.so > session [success=1 default=ignore] pam_succeed_if.so service in crond > quiet use_uid > session sufficient /lib64/security/pam_sss.so > session required pam_unix.so > bash-3.2# > > > > > bash-3.2# cat /etc/nsswitch.conf > # > # /etc/nsswitch.conf > # > # An example Name Service Switch config file. This file should be > # sorted with the most-used services at the beginning. > # > # The entry '[NOTFOUND=return]' means that the search for an > # entry should stop if the search in the previous entry turned > # up nothing. Note that if the search failed due to some other reason > # (like no NIS server responding) then the search continues with the > # next entry. > # > # Valid entries include: > # > # nisplus Use NIS+ (NIS version 3) > # nis Use NIS (NIS version 2), also called YP > # dns Use DNS (Domain Name Service) > # files Use the local files > # db Use the local database (.db) files > # compat Use NIS on compat mode > # hesiod Use Hesiod for user lookups > # [NOTFOUND=return] Stop searching if not found so far > # > > # To use db, put the "db" in front of "files" for entries you want to be > # looked up first in the databases > # > # Example: > #passwd: db files nisplus nis > #shadow: db files nisplus nis > #group: db files nisplus nis > > passwd: files sss > shadow: files > group: files sss > > #hosts: db files nisplus nis dns > hosts: files dns > > # Example - obey only what nisplus tells us... > #services: nisplus [NOTFOUND=return] files > #networks: nisplus [NOTFOUND=return] files > #protocols: nisplus [NOTFOUND=return] files > #rpc: nisplus [NOTFOUND=return] files > #ethers: nisplus [NOTFOUND=return] files > #netmasks: nisplus [NOTFOUND=return] files > > bootparams: nisplus [NOTFOUND=return] files > > ethers: files > netmasks: files > networks: files > protocols: files > rpc: files > services: files > > netgroup: nisplus > > publickey: nisplus > > automount: files nisplus > aliases: files nisplus > > bash-3.2# > > *The firewall and selinux is disabled* > > > I have tried to look into the traces which shows the following > > *bash-3.2# tail -f /var/log/messages* > Nov 11 09:15:58 bagira sssd: Starting up > Nov 11 09:15:58 bagira sssd[be[LDAP]]: Starting up > Nov 11 09:15:58 bagira sssd[nss]: Starting up > Nov 11 09:15:58 bagira sssd[pam]: Starting up > > > > > > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4): > Got request for [4097][1][name=nitinst] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): > calling ldap_search_ext with > [(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [objectClass] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [uid] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [userPassword] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [uidNumber] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [gidNumber] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [gecos] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [homeDirectory] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [loginShell] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [krbPrincipalName] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [cn] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [modifyTimestamp] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowLastChange] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowMin] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowMax] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowWarning] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowInactive] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowExpire] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowFlag] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [krbLastPwdChange] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [krbPasswordExpiration] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [pwdAttribute] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): > ldap_search_ext called, msgid = 1126 > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9): > OriginalDN: [uid=nitinst,ou=People,o=sample]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: ldap_result found nothing! > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): > Search result: Success(0), > *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_process] > (6): Search for users, returned 1 results.* > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0] > *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: ldap_result found nothing!* > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb > transaction (nesting: 0) > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): > Save user > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): > Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of > [nitinst]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): > Original memberOf is not available for [nitinst]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): > User principal is not available for [nitinst]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): > Adding [shadowLastChange]=[15288] to user attributes. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6): > Storing info for user nitinst > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_users_process] > (9): User 0 processed! > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb > transaction (nesting: 0) > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_done] (9): > Saving 1 Users - Done > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [acctinfo_callback] (4): > Request processed. Returned 0,0,Success > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9): dbus > conn: 8589BA0 > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9): > Dispatching. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_message_handler] (9): > Received SBUS method [getAccountInfo] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4): > Got request for [4099][1][name=nitinst] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_send] (9): > Retrieving info for initgroups call > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): > calling ldap_search_ext with > [(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [objectClass] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [uid] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [userPassword] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [uidNumber] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [gidNumber] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [gecos] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [homeDirectory] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [loginShell] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [krbPrincipalName] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [cn] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [modifyTimestamp] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowLastChange] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowMin] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowMax] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowWarning] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowInactive] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowExpire] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [shadowFlag] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [krbLastPwdChange] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [krbPasswordExpiration] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [pwdAttribute] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): > ldap_search_ext called, msgid = 1127 > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9): > OriginalDN: [uid=nitinst,ou=People,o=sample]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0] > *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: ldap_result found nothing!* > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): > Search result: Success(0), > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_user] (9): > Receiving info for the user > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: ldap_result found nothing! > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb > transaction (nesting: 0) > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_store] (9): > Storing the user > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): > Save user > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): > Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of > [nitinst]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): > Original memberOf is not available for [nitinst]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): > User principal is not available for [nitinst]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): > Adding [shadowLastChange]=[15288] to user attributes. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6): > Storing info for user nitinst > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_commit] (9): > Commit change > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb > transaction (nesting: 0) > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_process] > (9): Process user's groups > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): > calling ldap_search_ext with > [(&(memberuid=nitinst)(objectclass=posixGroup))][ou=People,o=sample]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [objectClass] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [cn] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [userPassword] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [gidNumber] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [memberuid] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): > Requesting attrs: [modifyTimestamp] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): > ldap_search_ext called, msgid = 1128 > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9): > OriginalDN: [cn=idsldap,ou=People,o=sample]. > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0] > *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: ldap_result found nothing!* > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): > Search result: Success(0), > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0] > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): > Trace: ldap_result found nothing! > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb > transaction (nesting: 0) > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb > transaction (nesting: 0) > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_done] (9): > Initgroups done > > > > From the traces what i could figure out is once it returned the search > result but still it gave the error *ldap_result found nothing! *even > though the entry in present on the ldap server. > Could you tell me if i'm missing any configuration step ?? > > Thanks**** > > _______________________________________________ > sssd-devel mailing list > sssd-devel(a)lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/sssd-devel > >

# data about the user itself. If you do not know this value, ask an # administrator. A [domain/LDAP] A debug_level = 9 A id_provider = ldap A auth_provider = ldap A ldap_schema = rfc2307 A access_provider = ldap A ldap_access_filter = memberOf=cn=idsldap,ou=People,o=sample A ldap_uri = ldap://lbullet.in.ibm.com A ldap_search_base = ou=People,o=sample A ldap_tls_reqcert = never A cache_credentials = false A enumerate = False

Jakub, The group entry looks like this cn=idsldap,ou=People,o=sample cn=idsldap objectclass=posixgroup objectclass=top gidnumber=201 memberuid=nitpta2 memberuid=nitinst memberuid=nitinst1 memberuid=nitback1 The group entry is under ou=people and any user is made member of a group by adding the memberuid attribute so i have kept ldap_schema as rfc2307 Thanks

Jakub, I tried the modifying sssd.confA to useA simple_allow_groups = idsldap Still it is not working.One thing I would like to ask .is my configuration correct in system-auth and nsswitch.conf file? Am i missing something. Also one more thing I have noticed in /var/log/secure log file Nov 11 13:34:58 bagira sshd[30879]: Address 9.118.25.17 maps to nitesh.in.ibm.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Nov 11 13:35:00 bagira sshd[30879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=9.118.25.17A user=nitback1 Nov 11 13:35:02 bagira sshd[30879]: Failed password for nitback1 from 9.118.25.17 port 4300 ssh2

Jakub, I tried the modifying sssd.conf to use simple_allow_groups = idsldap Still it is not working.One thing I would like to ask .is my configuration correct in system-auth and nsswitch.conf file? Am i missing something. Also one more thing I have noticed in /var/log/secure log file Nov 11 13:34:58 bagira sshd[30879]: Address 9.118.25.17 maps to nitesh.in.ibm.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Nov 11 13:35:00 bagira sshd[30879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=9.118.25.17 user=nitback1 Nov 11 13:35:02 bagira sshd[30879]: Failed password for nitback1 from 9.118.25.17 port 4300 ssh2 In above log i do not see entry for pam_sss I;m not sure why is this...

I have checked that file the setting is correct in that file below is the log *-bash-3.2# cat /etc/ssh/sshd_config |grep Use* #IgnoreUserKnownHosts no #UsePAM no UsePAM yes #X11UseLocalhost yes #UseLogin no #UsePrivilegeSeparation yes #PermitUserEnvironment no #UseDNS yes -bash-3.2# Is there any configuration i'm missing.?? Thanks And Regards Nitesh Mehare On Fri, Nov 11, 2011 at 6:51 PM, Stephen Gallagher <sgallagh(a)redhat.com&gt;wrote: > On Fri, 2011-11-11 at 14:48 +0530, Nitesh Mehare wrote: > > Jakub, > > I tried the modifying sssd.conf to use simple_allow_groups = idsldap > > Still it is not working.One thing I would like to ask .is my > > configuration correct in system-auth and nsswitch.conf file? > > Am i missing something. > > Also one more thing I have noticed in /var/log/secure log file > > > > Nov 11 13:34:58 bagira sshd[30879]: Address 9.118.25.17 maps to > > nitesh.in.ibm.com, but this does not map back to the address - > > POSSIBLE BREAK-IN ATTEMPT! > > Nov 11 13:35:00 bagira sshd[30879]: pam_unix(sshd:auth): > > authentication failure; logname= uid=0 euid=0 tty=ssh ruser= > > rhost=9.118.25.17 user=nitback1 > > Nov 11 13:35:02 bagira sshd[30879]: Failed password for nitback1 from > > 9.118.25.17 port 4300 ssh2 > > > > In above log i do not see entry for pam_sss I;m not sure why is > > this... > > > Can you make sure that your /etc/ssh/sshd_config file has 'UsePAM yes' > in it? That may make the difference. > > _______________________________________________ > sssd-devel mailing list > sssd-devel(a)lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/sssd-devel > >

On Mon, 2011-11-14 at 10:34 +0530, Nitesh Mehare wrote: > So any setting i'm missing.I'm not able to figure out why this is not > working,,,:( Would you mind showing us /etc/pam.d/sshd please? I wonder if it might not be including system-auth (and therefore not trying to use SSSD). The problem here is that SSHD is not actually *calling* pam_sss.so, which is why authentication isn't working. It's not an SSSD issue. _______________________________________________ sssd-devel mailing list sssd-devel(a)lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel

On Tue, Nov 15, 2011 at 09:24:57AM +0530, Nitesh Mehare wrote: > Here is the snapshot of the file > > -bash-3.2# cat /etc/pam.d/sshd > #%PAM-1.0 > authA A A A A A includeA A A A A system-auth > accountA A A requiredA A A A pam_nologin.so > accountA A A includeA A A A A system-auth > passwordA A includeA A A A A system-auth > sessionA A A optionalA A A A pam_keyinit.so force revoke > sessionA A A includeA A A A A system-auth > sessionA A A requiredA A A A pam_loginuid.so > -bash-3.2# Provided that you still use the same system-auth file as you provided in one of the first comments, everything looks fine. Can you run: strace -e open su - $username That should tell us whether the pam stack is actually opening the module or not. _______________________________________________ sssd-devel mailing list sssd-devel(a)lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel

is that the output which is expected in the trace. Something missing in the trace which suggest any config problem??? On Tue, Nov 15, 2011 at 5:22 PM, Nitesh Mehare <nitesh26(a)gmail.com&gt; wrote: This is the output of strace for the user which is in ldap server. bash-3.2# strace -e open su - nitback1 open("/etc/ld.so.cache", O_RDONLY)A A A A A = 3 open("/lib64/libpam.so.0", O_RDONLY)A A A = 3 open("/lib64/libpam_misc.so.0", O_RDONLY) = 3 open("/lib64/libcrypt.so.1", O_RDONLY)A = 3 open("/lib64/libdl.so.2", O_RDONLY)A A A A = 3 open("/lib64/libc.so.6", O_RDONLY)A A A A A = 3 open("/lib64/libaudit.so.0", O_RDONLY)A = 3 open("/usr/lib/locale/locale-archive", O_RDONLY) = 3 open("/etc/nsswitch.conf", O_RDONLY)A A A = 3 open("/etc/ld.so.cache", O_RDONLY)A A A A A = 3 open("/lib64/libnss_files.so.2", O_RDONLY) = 3 open("/etc/passwd", O_RDONLY)A A A A A A A A A A = 3 open("/etc/ld.so.cache", O_RDONLY)A A A A A = 3 open("/lib64/libnss_sss.so.2", O_RDONLY) = 3 open("/etc/pam.d/su-l", O_RDONLY)A A A A A A = 4 open("/etc/pam.d/su", O_RDONLY)A A A A A A A A = 5 open("/lib64/security/pam_rootok.so", O_RDONLY) = 6 open("/etc/ld.so.cache", O_RDONLY)A A A A A = 6 open("/lib64/libselinux.so.1", O_RDONLY) = 6 open("/lib64/libsepol.so.1", O_RDONLY)A = 6 open("/etc/selinux/config", O_RDONLY)A A = 6 open("/proc/mounts", O_RDONLY)A A A A A A A A A = 6 open("/etc/pam.d/system-auth", O_RDONLY) = 6 open("/lib64/security/pam_env.so", O_RDONLY) = 7 open("/lib64/security/pam_unix.so", O_RDONLY) = 7 open("/etc/ld.so.cache", O_RDONLY)A A A A A = 7 open("/usr/lib64/libcrack.so.2", O_RDONLY) = 7 open("/lib64/libnsl.so.1", O_RDONLY)A A A = 7 open("/lib64/security/pam_succeed_if.so", O_RDONLY) = 7 open("/lib64/security/pam_sss.so", O_RDONLY) = 7

Thanks Jakub for looking into the issue.. According to your suggesstion I have modified my system-auth file..Now my current config looks like this... * bash-3.2# cat /etc/pam.d/system-auth* #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient /lib64/security/pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] /lib64/security/pam_sss.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient /lib64/security/pam_sss.so use_authtok password required pam_deny.so #session required pam_mkhomedir.so umask=0022 skel=/etc/skel/ #session optional pam_keyinit.so revoke #session required pam_limits.so #session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid #session sufficient /lib64/security/pam_sss.so #session required pam_unix.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so umask=0022 skel=/etc/skel/ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use _uid session required pam_unix.so session optional pam_sss.so bash-3.2# After this I have restarted the sssd processs using the cmd *service sssd restart* Then I tried the authentication with strace su - nitback1 which gave the output.which is in the attached file . But this did not prompt me for any password it stopped at the below like *rt_sigprocmask(SIG_UNBLOCK, [ALRM TERM], NULL, 8) = 0 wait4(-1, $* Tha above trace I have take with selinux is disabled.The setting of selinux is as follows *bash-3.2# cat /etc/selinux/config* # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - SELinux is fully disabled. SELINUX=disabled # SELINUXTYPE= type of policy in use. Possible values are: # targeted - Only targeted network daemons are protected. # strict - Full SELinux protection. SELINUXTYPE=targeted bash-3.2# I'm not sure how to check for AVC denials when selinux is set to enforcing.Could you tell me how to do that. Thanks... On Wed, Nov 16, 2011 at 7:25 PM, Jakub Hrozek <jhrozek(a)redhat.com&gt; wrote: > On Tue, Nov 15, 2011 at 05:24:08PM +0530, Nitesh Mehare wrote: > > is that the output which is expected in the trace. > > Something missing in the trace which suggest any config problem??? > > > > On Tue, Nov 15, 2011 at 5:22 PM, Nitesh Mehare <nitesh26(a)gmail.com&gt; > wrote: > > > > This is the output of strace for the user which is in ldap server. > > > > bash-3.2# strace -e open su - nitback1 > > open("/etc/ld.so.cache", O_RDONLY)A A A A A = 3 > > open("/lib64/libpam.so.0", O_RDONLY)A A A = 3 > > open("/lib64/libpam_misc.so.0", O_RDONLY) = 3 > > open("/lib64/libcrypt.so.1", O_RDONLY)A = 3 > > open("/lib64/libdl.so.2", O_RDONLY)A A A A = 3 > > open("/lib64/libc.so.6", O_RDONLY)A A A A A = 3 > > open("/lib64/libaudit.so.0", O_RDONLY)A = 3 > > open("/usr/lib/locale/locale-archive", O_RDONLY) = 3 > > open("/etc/nsswitch.conf", O_RDONLY)A A A = 3 > > open("/etc/ld.so.cache", O_RDONLY)A A A A A = 3 > > open("/lib64/libnss_files.so.2", O_RDONLY) = 3 > > open("/etc/passwd", O_RDONLY)A A A A A A A A A A = 3 > > open("/etc/ld.so.cache", O_RDONLY)A A A A A = 3 > > open("/lib64/libnss_sss.so.2", O_RDONLY) = 3 > > open("/etc/pam.d/su-l", O_RDONLY)A A A A A A = 4 > > open("/etc/pam.d/su", O_RDONLY)A A A A A A A A = 5 > > open("/lib64/security/pam_rootok.so", O_RDONLY) = 6 > > open("/etc/ld.so.cache", O_RDONLY)A A A A A = 6 > > open("/lib64/libselinux.so.1", O_RDONLY) = 6 > > open("/lib64/libsepol.so.1", O_RDONLY)A = 6 > > open("/etc/selinux/config", O_RDONLY)A A = 6 > > open("/proc/mounts", O_RDONLY)A A A A A A A A A = 6 > > open("/etc/pam.d/system-auth", O_RDONLY) = 6 > > open("/lib64/security/pam_env.so", O_RDONLY) = 7 > > open("/lib64/security/pam_unix.so", O_RDONLY) = 7 > > open("/etc/ld.so.cache", O_RDONLY)A A A A A = 7 > > open("/usr/lib64/libcrack.so.2", O_RDONLY) = 7 > > open("/lib64/libnsl.so.1", O_RDONLY)A A A = 7 > > open("/lib64/security/pam_succeed_if.so", O_RDONLY) = 7 > > open("/lib64/security/pam_sss.so", O_RDONLY) = 7 > > So it seems pam_sss is found ^^^^ > > I have one suggestion as per the system-auth PAM config, I think the > session is not correct, authconfig configures the PAM stack like this: > --- > session optional pam_keyinit.so revoke > session required pam_limits.so > session optional pam_mkhomedir.so umask=0022 skel=/etc/skel/ > session [success=1 default=ignore] pam_succeed_if.so service in crond > quiet use_uid > session required pam_unix.so > session optional pam_sss.so > --- > > Can you check two more things for me? Can you look if you get any AVC > denials provided SELinux is set to enforcing (or retry with setenforce 0 > set for that test). > > Also, can you send the whole strace output? IOW, run: > strace su - nitback1 > ideally as non-root so you're prompted for password > _______________________________________________ > sssd-devel mailing list > sssd-devel(a)lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/sssd-devel >

Was anybody able to look at the trace... Thanks ....

Tha above trace I have take with selinux is disabled.The setting of selinux is as follows bash-3.2# cat /etc/selinux/config # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: #A A A A A A enforcing - SELinux security policy is enforced. #A A A A A A permissive - SELinux prints warnings instead of enforcing. #A A A A A A disabled - SELinux is fully disabled. SELINUX=disabled # SELINUXTYPE= type of policy in use. Possible values are: #A A A A A A targeted - Only targeted network daemons are protected. #A A A A A A strict - Full SELinux protection. SELINUXTYPE=targeted bash-3.2# I'm not sure how to check for AVC denials when selinux is set to enforcing.Could you tell me how to do that. Thanks...

I tried putting debug level 9 pam section of sssd.conf Below is the messages in sssd_pam.log

The initial messages are for when i restart the sssd service.I do not see any specific messaages when i try to do authentication. I'm not sure how to move fwd from here cause till now the settings i have done seems to be correct. Would like to thank for the help I'm getting in this forum hope it will help resolving my issue.

Anyone help me out how can i move fwd from here...

is this b'cpz of any setting i'm missing related pam..??

On Tue, Nov 29, 2011 at 12:47 AM, Stephen Gallagher <sgallagh(a)redhat.com&gt; wrote: On Fri, 2011-11-25 at 18:55 +0530, Nitesh Mehare wrote: > Anyone help me out how can i move fwd from here... I'm not really sure how to proceed from here. The two logs you sent are mutually-exclusive. There's no way at all that the sssd_pam.log should be showing no activity while the strace is describing a send-and-receive to the SSSD pam socket. So one of those is wrong. Did you maybe take those logs from a different machine?

I'm not sure this is helpful but this is what i have log in pam log file.