sssd-users May 2023

sssd-users@lists.fedorahosted.org

9 participants
9 discussions

Starting SSSD without root
by Tero Saarni 20 Jan '26

20 Jan '26

Hi, I'm trying to run SSSD inside docker container without root user. The container is executed in OpenShift cluster which does not allow running as root inside container. SSSD requires root and checks for this specifically. Is there any workaround for this? I believe the limitation is implemented for security reasons, in order to have most critical parts executed as root and have it drop privileges for other parts but this now completely blocks using SSSD in the above environment. -- Tero

5 21

filter_users using user id
by Francois Rigault 22 Mar '25

22 Mar '25

Greetings, we run some podman containers that come with their own local users, such as this one: ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin when running a top on the server, top tries to resolve the user name for that id and fails, however there is still a BE_REQ_USER request sent: (2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=42461] I would hope to get rid of these requests against the domain. unfortunately in MY.DOMAIN.NET there are uids below and above this number, so I cannot rely on the "min_id" parameter to filter users. I would like to know if it is possible to support using user ids in the [nss] filter_users to prevent those user requests to the domain, or if anyone has any other suggestion. I increased the entry_negative_timeout to reduce the number of queries, but filtering them out entirely would be even better. Thank you!

4 4

SSSD.Service not starting
by Manjot Singh 12 Feb '25

12 Feb '25

● sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Wed 2020-01-29 14:12:32 EST; 9s ago Process: 23217 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=4) Main PID: 23217 (code=exited, status=4) Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Service RestartSec=100ms expired, scheduling restart. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Scheduled restart job, restart counter is at 5. Jan 29 14:12:32 pop-os systemd[1]: Stopped System Security Services Daemon. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Start request repeated too quickly. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Failed with result 'exit-code'. Jan 29 14:12:32 pop-os systemd[1]: Failed to start System Security Services Daemon.

3 2

Only IPv4 addresses in /var/lib/sss/pubconf/kdcinfo.DOMAIN
by Brian J. Murrell 22 Jul '23

22 Jul '23

On my dual-stack network where some machines actually don't have IPv4 connectivity I am finding that whatever is writing IP addresses into /var/lib/sss/pubconf/kdcinfo.DOMAIN is only writing the IPv4 addresses and not the KDC's IPv6 addresses. The result is that such an IPv6 machine cannot reach a KDC until I remove that file. It ends up being recreated at some subsequent point again with only the KDC's IPv4 addresses. Is this a bug or a problem with my configuration? Cheers, b.

2 3

Frequently disconnected from domain
by Sac Isilia 29 May '23

29 May '23

Hi Team, We are using sssd in our environment for authentication of AD users. But it disconnect from domain for unknown reasons. Can someone help if there is some best practice or script that automatically rejoin the server to domain as soon as it disconnects? It has become pain for us to do it manually. Regards Sachin Kumar

3 8

cldap error messages on sssd domain log
by Maverick . 19 May '23

19 May '23

Hi, I have my Fedora 36 laptop joined to an AD with sssd-2.7.4. AD DCs are Fedora 37 servers with Samba 4.17.8. Everything seems to be working fine, though i see this cldap error messages on my sssd_test.com.log: * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_done] (0x0040): Unable to get site and forest information [2]: No such file or directory * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server] * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information * ... skipping repetitive backtrace ... (2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_done] (0x0040): Unable to get site and forest information [2]: No such file or directory Anyone knows what this might be?

3 6

Mixing both local files and LDAP for automount maps.
by Prentice Bisbal 15 May '23

15 May '23

SSSD Users, I'm having a problem using a combination of both local files and LDAP as sources for automount information. Historically, our site has always used LDAP for automount map information, and all systems used the same NFS home directories. I'm now setting up a new HPC cluster, and I want the home directories (mounted as /u/<username>to be local to that cluster. The home directories will be provided by the master note of that cluster, but I still want to use the LDAP provided mount information for our project directories (mounted as /p/<project_name>. I want /etc/auto.home to be consulted for /u, but use the auto.projects automountmap in LDAP for /p. This should be simple, but it's not working for me: # automount -m autofs dump map information =========================== global options: none configured Mount point: /u source(s): instance type(s): file map: /etc/auto.home * | ranger-master:/home/& Mount point: /p source(s): instance type(s): sss map: auto.projects no keys found in map I created this /etc/auto.master file: /u /etc/auto.home /p auto.projects And have this in my /etc/auto.home: * cluster-master:/home/& I could swear this worked last week, but is not working now. My /etc/nsswitch.conf contains the following for entry for automounting: automount: files sss and my /etc/sssd/sssd.conf looks like this: [domain/default] id_provider = ldap autofs_provider = ldap sudo_provider = ldap cache_credentials = True auth_provider = krb5 chpass_provider = krb5 krb5_kpasswd = kerberos.example.com krb5_server = kerberos.example.com krb5_store_password_if_offline = True krb5_realm = PPPL.GOV ldap_uri =ldap://ldap1.example.com,ldap://ldap2.example.com ldap_search_base = dc=unix,dc=example,dc=com ldap_id_use_start_tls = False ldap_tls_cacertdir = /etc/openldap/cacerts ldap_autofs_search_base = ou=mounts,dc=unix,dc=example,dc=com ldap_autofs_map_object_class = automountMap ldap_autofs_map_name = ou ldap_autofs_entry_object_class = automount ldap_autofs_entry_key = cn ldap_autofs_entry_value = automountInformation enumerate = true [sssd] config_file_version = 2 services = nss, pam, autofs, sudo domains = default [nss] [pam] [autofs] [sudo] What am I missing or doing wrong here? -- Prentice

1 1

[SSSD] Announcing SSSD 2.9.0
by Pavel Březina 05 May '23

05 May '23

# SSSD 2.9.0 The SSSD team is announcing the release of version 2.9.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.0 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.0.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### General information * `sss_simpleifp` library is deprecated and might be removed in further releases. Those who are interested to keep using it awhile should configure its build explicitly using `--with-libsifp` `./configure` option. * "Files provider" (i.e. `id_provider = files`) is deprecated and might be removed in further releases. Those who are interested to keep using it awhile should configure its build explicitly using `--with-files-provider` `./configure` option. Or consider using "Proxy provider" with `proxy_lib_name = files` instead. * Previously deprecated `--enable-files-domain` configure option, which was used to manage default value of the `enable_files_domain` config option, is now removed. * Long time unused '--enable-all-experimental-features' configure option was removed. * SSSD will no longer warn about changed defaults when using `ldap_schema = rfc2307` and default autofs mapping. This warning was introduced in 1.14 to loudly warn about different default values. ### New features * New passkey functionality, which will allow the use of FIDO2 compliant devices to authenticate a centrally managed user locally. Moreover, in the case of a FreeIPA user, it can also issue a Kerberos ticket automatically with upcoming FreeIPA version 4.11. * Add support for ldapi:// URLs to allow connections to local LDAP servers * NSS IDMAP has two new methods: `getsidbyusername` and `getsidbygroupname` Note: support for passkey is in its initial phase and the authentication policy will be adjusted in future versions. #### Packaging changes for passkey * Include passkey subpackage and dependency for libfido2. #### Configuration changes for passkey * New options to enable and tune passkey behavior: `pam_passkey_auth`, `ldap_user_passkey`, `passkey_verification`, `passkey_child_timeout`, `interactive`, `interactive_prompt`, `touch` and `touch_prompt`. * `--with-passkey` is a new configuration option to enable building passkey authentication. ### Important fixes * A regression when running sss_cache when no SSSD domain is enabled would produce a syslog critical message was fixed. ### Configuration changes * Default value of `cache_first` option was changed to `true` in case SSSD is built without `files provider`. * ipa_access_order parameter introduced. It behaves much like ldap_access_order but affects IPA domains (id_provider = ipa) and accepts limited values. Please see sssd-ipa(5) for more information.

1 0

SSSD and NSS problem with gid resolution with two domains (freeipa + Active Directory)
by David Serrano Amarelle 02 May '23

02 May '23

First, I would like to appreciate all the help you could provide me. I have an issue with sssd and nss that I don't still understand quite well... The point is that I have configured some servers with 2 active domains. The first domain is a freeipa managed environment and the second one is an AD domain. But I recently noticed that if I try to obtain the uids and gids for several users, the groupnames have the right gid, but groupnames are wrong. I mean, what I detected is even all gids an uids retrieved by the id command are right, the names of the groups shown, sometimes are from the other domain. I think it always retrieve the name of the group of the first domain (domain1.com) if the gid exists there, but if don't, it will look for it in the sencond domain (addomain2.com) It seems this is a problem with the NSS, not exactly with the SSSD, event they are very linked. So, please, If this is not the better place to ask for this, I will appreciate help to look for help in another forum. For instance: [root@lab6 ~]# id user1 uid=105806(user1) gid=106520(group1) groups=106520(group1),104446(group2),104870(group3),102242(group5),100327(group6) where: * user1 is an user from the AD domain (addomain2.com) * gis are perfectly obtained * group1, group2 and group3 are from the AD domain (addomain2.com) * group5 and group6 are groups OR USERS form the FREEIPA domain (domain1.com) I could understand that it is normal that it happens if I use the sortname way "id user1", but I think that not should happen with the long-user way: "ia user1(a)addomain2.com". I mean, this also happens if I do: [root@lab6 ~]# id user1(a)addomain2.com uid=105806(user1) gid=106520(group1) groups=106520(group1),104446(group2),104870(group3),102242(group5),100327(group6) This is my sssd.conf: [root@lab6 ~]# cat /etc/sssd/sssd.conf [domain/domain1.com] id_provider = ipa ipa_server = _srv_, freeipa01.domain1.com ipa_domain = domain1.com ipa_hostname = lab6.domain1.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True [domain/addomain2.com] ad_domain = addomain2.com krb5_realm = addomain2.com realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash use_fully_qualified_names = False fallback_homedir = /home/%u@%d access_provider = ad krb5_keytab = /etc/krb5.keytab.ad ldap_krb5_keytab = /etc/krb5.keytab.ad ldap_id_mapping = false ad_enabled_domains = addomain2.com ad_gpo_access_control = disabled dyndns_update = false dns_resolver_timeout = 10 dns_resolver_op_timeout = 10 krb5_auth_timeout = 30 timeout = 30 [sssd] services = nss, pam, ssh, sudo domains = domain1.com,addomain2.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [session_recording] [root@lab6 ~]# realm list domain1.com type: kerberos realm-name: domain1.com domain-name: domain1.com configured: kerberos-member server-software: ipa client-software: sssd required-package: ipa-client required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd login-formats: %U login-policy: allow-realm-logins addomain2.com type: kerberos realm-name: addomain2.com domain-name: addomain2.com configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools login-formats: %U login-policy: allow-realm-logins Does I have any sense for you? Did I miss something in my configuration? Is there any way to tell NSS what domain should use in SSSD configuration? Thanks a lot for your help. Regards, david

2 4

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users May 2023