Odd SSSD behavior
by Erinn Looney-Triggs
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
This may or may not be related to FreeIPA, but it definitely is
related to SSSD, so I reckoned I would start here.
I have two FreeIPA servers, after a password change for my account,
one FreeIPA server works with the new password, and the other only
works with the old password.
However, kinit works fine on both, and if I understand all the moving
parts correctly a kinit is going to go against the KDC on the
respective IPA server, which backs into LDAP, yadda yadda, in short my
password IS changed on both, it is not a sync issue (I believe), but
SSSD is flunking out.
Now I have run a debug session for SSSD and I THINK the following is
the relevant part:
(Mon May 18 18:57:52 2015) [sssd[be[example.com]]] [sasl_bind_send]
(0x0100): Exe
cuting sasl bind mech: GSSAPI, user: host/ipa2.example.com
(Mon May 18 18:57:53 2015) [sssd[be[example.com]]] [sasl_bind_send]
(0x0020): ldap_sasl_bind failed (49)[Invalid credentials]
(Mon May 18 18:57:53 2015) [sssd[be[example.com]]] [sasl_bind_send]
(0x0080): Extended failure message: [SASL(-14): authorization failure:
mech ANONYMOUS is too weak]
Now I haven't tracked all this down, but I figured I would ask while I
was looking it all up, lest anyone have any great ideas.
Why one IPA server is working and the other isn't, well, clearly there
must be a config difference, but I am not sure what it is yet.
Thanks,
- -Erinn
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBCAAGBQJVbJJRAAoJEFg7BmJL2iPOUOMH/jxkN8h3jAgjbdzkbUN0LTxX
T/W5iP1Cc0eDaKb9wBcoc10MxR4P6YvEECcGdtYTfBL/tAh0DECTpgZ4vC0yzrtD
ITW5Gz3LIKhR8ojzfMhkYfQfdcC9Mit8jOhmdAXoIqYnknSu2tT3bQP3BpEW/1s6
1JLye6mwjYGfapezTB0EAnnJ9Le6Ns9s9Y6+u87+9lxi7wuIFbKpYl8D/d2CU0JE
vUyjGKdImBnYgec1r+cKMBETp22RbCgE4czX21UoRTyDTaUsaPMZUrxqYZXLKrOW
AYMPCjEwgRW3iqUdY4YMeVa7QVeVFQzNNi9ZBHt4aCwugUr5hjSUFHaH4a2fQI0=
=TFjN
-----END PGP SIGNATURE-----
8 years, 10 months
- 2
- 3