sssd-users June 2026

sssd-users@lists.fedorahosted.org

8 participants
5 discussions

Correctly 'reset' a user access...
by Marco Gaiarin 26 Jun '26

26 Jun '26

[Subject is a bit misleading, but really i don't know how to write it...] In our domain we have some 'guest' users, that can logon to PCs, but data have to be wiped out on logoff. In a SSSD-joined box (ZorinOS/Ubuntu) i've added to /etc/rc.local, simply: # Remove on reboot guests homes. # for h in `find /home/ -maxdepth 1 -type d -group 'domain guests'`; do rm -rf $h if [ -x "/usr/sbin/sss_cache" ]; then sss_cache --user `basename $h`; fi done I've added sss_cache call because if i remove only the home, i cannot relogon (GDM throw an error...). In this way, work; but i can relogon as guest user if and only if i do a logon with another domain user; eg: a) test logon with guest user, worked b) reboot c) logon with guest user, failed d) logon with another domain user (tipically, non-guest) e) logon with guest user, worked What i'm doing wrong? Thanks. --

2 3

Export certificates for WPA/TLS...
by Marco Gaiarin 19 Jun '26

19 Jun '26

In our domain we use WPA Enterprise with TLS, managing certificates and wifi profiles for windows joined clients with the windows tools (windows CA, certificate generation and deployments for clients, ...). For non-windows client (mostly, linux) we export certificate with: Get-Certificate -Template "NPSClientno-domain" -DnsName clienthostname -SubjectName "cn=clienthostname" -CertStoreLocation cert:\LocalMachine\My to the local storage of a windows box, then with certlm.msc we export the certificate and then load to the client. I know that there's some stuff to do this automagically (eg, Ubuntu adsys; but also Samba seems have some tool...). But there's some way to simply export the certificate directly from Linux? I hope i was clear. Thanks. --

1 0

Trouble joining a forest - error on root domain
by Marco Gaiarin 19 Jun '26

19 Jun '26

I've tried to join an Ubuntu machine (22.04, latest upgrade applied) to our domain, composed of a root domain (ad.myshortdomain.it) and 4 other domain (lom.ad.myshortdomain.it, ven.ad.myshortdomain.it, fvg.ad.myshortdomain.it, pug.ad.myshortdomain.it), in a forest. I've joined the ubuntu box to one of the subdomain (ven.ad.myshortdomain.it). Join worked as expected, but i was not able to authenticate. I catch error like: [...] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [be_resolve_server_process] (0x0200): [RID#6] Found address for server lnfdc2.ad.myshortdomain.it: [10.7.5.22] TTL 2115 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_kinit_kdc_resolved] (0x1000): [RID#6] KDC resolved, attempting to get TGT... [...] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0100): [RID#6] Executing sasl bind mech: GSS-SPNEGO, user: CNL-RICERCA$ * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x4000): [RID#6] SASL: GSSAPI client step 1 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x4000): [RID#6] SASL: GSSAPI client step 1 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x0040): [RID#6] SASL: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0020): [RID#6] ldap_sasl_interactive_bind_s failed (-2)[Local error] (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_cli_connect_recv] (0x0040): [RID#6] Unable to establish connection [1432158227]: Authentication Failed ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0020): [RID#6] ldap_sasl_interactive_bind_s failed (-2)[Local error] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0080): [RID#6] Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x1000): [RID#6] Waiting for child [3942]. * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x0100): [RID#6] child [3942] finished successfully. * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_cli_connect_recv] (0x0040): [RID#6] Unable to establish connection [1432158227]: Authentication Failed ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 14:22:48): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x0020): [RID#6] waitpid did not found a child with changed status. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [_be_fo_set_port_status] (0x8000): [RID#6] Setting status: PORT_NOT_WORKING. Called from: ../src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_recv: 2125 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [fo_set_port_status] (0x0100): [RID#6] Marking port 389 of server 'lnfdc2.ad.myshortdomain.it' as 'not working' * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [fo_set_port_status] (0x0400): [RID#6] Marking port 389 of duplicate server 'lnfdc2.ad.myshortdomain.it' as 'not working' * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_handle_release] (0x2000): [RID#6] Trace: sh[0x61ee25d7b110], connected[1], ops[(nil)], ldap[0x61ee25d7aa80], destructor_lock[0], release_memory[0] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [remove_connection_callback] (0x4000): [RID#6] Successfully removed connection callback. and i was forced to limit access to subdomain, adding in /etc/sssd/sssd.conf: ad_enabled_domains = ven.ad.myshortdomain.it After that, still i catch errors that prevent me to open sessions, like: * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_get_generic_op_finished] (0x0400): [RID#5] Search result: Referral(10), 0000202B: RefErr: DSID-0310079D, data 0, 1 access points ref 1: 'ad.myshortdomain.it' * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_get_generic_ext_add_references] (0x1000): [RID#5] Additional References: ldap://ad.myshortdomain.it/cn=%7BA66B11F6-4E7E-42F7-A0C0-B1548B3378B7%7D,cn=policies,cn=system,DC=ad,DC=lnf,DC=it * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_op_destructor] (0x2000): [RID#5] Operation 21 finished * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sss_domain_get_state] (0x1000): [RID#5] Domain ven.ad.myshortdomain.it is Active * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_send] (0x0020): [RID#5] Could not find domain matching [ad.myshortdomain.it] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#5] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile) ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x0200): [RID#5] communication error on cached connection, moving to next server * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x4000): [RID#5] advising for connection retry #1 * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x4000): [RID#5] releasing operation connection * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_release_conn_data] (0x4000): [RID#5] Releasing unused connection with fd [20] * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_handle_release] (0x2000): [RID#5] Trace: sh[0x58cb6cdc3bc0], connected[1], ops[(nil)], ldap[0x58cb6cdc2c10], destructor_lock[0], release_memory[0] * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [remove_connection_callback] (0x4000): [RID#5] Successfully removed connection callback. * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#5] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile) ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_som_attrs_done] (0x0040): [RID#11] no attrs found for SOM; try next SOM * ... skipping repetitive backtrace ... (2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_send] (0x0020): [RID#11] Could not find domain matching [ad.myshortdomain.it] * ... skipping repetitive backtrace ... (2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#11] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile) * ... skipping repetitive backtrace ... (2026-05-22 15:48:13): [be[ven.ad.myshortdomain.it]] [sbus_issue_request_done] (0x0040): sssd.dataprovider.pamHandler: Error [1432158213]: Terminated (2026-05-22 15:48:13): [be[ven.ad.myshortdomain.it]] [sbus_issue_request_done] (0x0040): sssd.dataprovider.pamHandler: Error [1432158213]: Terminated seems to me related to GPO, still of the root domain; i was forced to add also to /etc/sssd/sssd.conf: ad_gpo_access_control = disabled ad_gpo_ignore_unreadable = True ad_gpo_default_right = permit What is wrong on my setup? Thanks. --

4 11

Understanding uidNumber/gidNumber Filters
by Al Griff 09 Jun '26

09 Jun '26

I'm trying to build a caching proxy using OpenLDAP to improve login times against a remote LDAP directory. This requires me to understand what queries SSSD is running so I can craft appropriate templates for slapd. After banging my head against this for some days I realised the problem is slapd does not support caching of filters using negation. Unfortunately SSSD appears to append the following to the end of many queries for posixUser or posixGroup (&(uidNumber=*)(!(uidNumber=0)) (&(gidNumber=*)(!(gidNumber=0)) So, two questions. 1) what is the purpose of this? and 2) can it be disabled in any way?

3 3

05 Jun '26

I have a laptop enrolled with a FreeIPA server. Often, first login attempts fail and I have these logs in /var/log/sssd/krb5_child.log : (2026-06-04 15:55:33): [krb5_child[2738]] [validate_tgt] (0x0020): [RID#485] error reading keytab [/etc/krb5.keytab], not verifying TGT. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_log_process_caps] (0x0100): [RID#485] Starting under ruid=995, euid=995, suid=995 : rgid=993, egid=993, sgid=993 * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_log_process_caps] (0x0100): [RID#485] With following capabilities: CAP_DAC_READ_SEARCH: effective = 0 , permitted = *1*, inheritable = 0 , bounding = *1* CAP_SETGID: effective = 0 , permitted = *1*, inheritable = 0 , bounding = *1* CAP_SETUID: effective = 0 , permitted = *1*, inheritable = 0 , bounding = *1* * (2026-06-04 15:54:23): [krb5_child[2738]] [unpack_buffer] (0x1000): [RID#485] total buffer size: [146] * (2026-06-04 15:54:23): [krb5_child[2738]] [unpack_buffer] (0x0100): [RID#485] cmd [249 (pre-auth)] uid [1462] gid [1462] validate [true] enterprise principal [false] offline [true] UPN [william.oprandi(a)FR.OTERA.LAN] * (2026-06-04 15:54:23): [krb5_child[2738]] [unpack_buffer] (0x0100): [RID#485] ccname: [KEYRING:persistent:1462] old_ccname: [KEYRING:persistent:1462] keytab: [/etc/krb5.keytab] * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_krb5_cc_verify_ccache] (0x2000): [RID#485] TGT not found or expired. * (2026-06-04 15:54:23): [krb5_child[2738]] [k5c_ccache_check] (0x4000): [RID#485] Old ccache is [KEYRING:persistent:1462] and is active and TGT is valid. * (2026-06-04 15:54:23): [krb5_child[2738]] [k5c_ccache_check] (0x4000): [RID#485] Reusing old ccache [KEYRING:persistent:1462] * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_log_process_caps] (0x0100): [RID#485] Running under ruid=1462, euid=1462, suid=995 : rgid=1462, egid=1462, sgid=993 * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_log_process_caps] (0x0100): [RID#485] With following capabilities: (nothing) * (2026-06-04 15:54:23): [krb5_child[2738]] [k5c_setup] (0x0400): [RID#485] Updating principal * (2026-06-04 15:54:23): [krb5_child[2738]] [set_lifetime_options] (0x0100): [RID#485] No specific renewable lifetime requested. * (2026-06-04 15:54:23): [krb5_child[2738]] [set_lifetime_options] (0x0100): [RID#485] No specific lifetime requested. * (2026-06-04 15:54:23): [krb5_child[2738]] [main] (0x0400): [RID#485] Will perform pre-auth * (2026-06-04 15:54:23): [krb5_child[2738]] [tgt_req_child] (0x1000): [RID#485] Attempting to get a TGT * (2026-06-04 15:54:23): [krb5_child[2738]] [get_and_save_tgt] (0x0400): [RID#485] Attempting kinit for realm [FR.OTERA.LAN] * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_krb5_auth_methods_request] (0x4000): [RID#485] Got request [password]. * (2026-06-04 15:54:23): [krb5_child[2738]] [request_password] (0x4000): [RID#485] Setting password prompting. * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_krb5_auth_methods_request] (0x4000): [RID#485] Request found for password * (2026-06-04 15:54:23): [krb5_child[2738]] [k5c_send_data] (0x0200): [RID#485] Received error code 0 * (2026-06-04 15:54:23): [krb5_child[2738]] [pack_response_packet] (0x2000): [RID#485] response packet size: [24] * (2026-06-04 15:54:23): [krb5_child[2738]] [k5c_send_data] (0x4000): [RID#485] Response sent. * (2026-06-04 15:55:33): [krb5_child[2738]] [unpack_buffer] (0x1000): [RID#485] total buffer size: [157] * (2026-06-04 15:55:33): [krb5_child[2738]] [unpack_buffer] (0x0100): [RID#485] cmd [241 (auth)] uid [1462] gid [1462] validate [true] enterprise principal [false] offline [false] UPN [william.oprandi(a)FR.OTERA.LAN] * (2026-06-04 15:55:33): [krb5_child[2738]] [unpack_buffer] (0x0100): [RID#485] ccname: [KEYRING:persistent:1462] old_ccname: [KEYRING:persistent:1462] keytab: [/etc/krb5.keytab] * (2026-06-04 15:55:33): [krb5_child[2738]] [k5c_setup] (0x0400): [RID#485] Principal unchanged, keeping existing * (2026-06-04 15:55:33): [krb5_child[2738]] [set_lifetime_options] (0x0100): [RID#485] No specific renewable lifetime requested. * (2026-06-04 15:55:33): [krb5_child[2738]] [set_lifetime_options] (0x0100): [RID#485] No specific lifetime requested. * (2026-06-04 15:55:33): [krb5_child[2738]] [set_canonicalize_option] (0x0100): [RID#485] Canonicalization is set to [true] * (2026-06-04 15:55:33): [krb5_child[2738]] [sss_krb5_auth_methods_answer] (0x4000): [RID#485] Got question [password]. * (2026-06-04 15:55:33): [krb5_child[2738]] [sss_krb5_expire_callback_func] (0x2000): [RID#485] exp_time: [14365252] * (2026-06-04 15:55:33): [krb5_child[2738]] [validate_tgt] (0x0020): [RID#485] error reading keytab [/etc/krb5.keytab], not verifying TGT. ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-06-04 15:55:33): [krb5_child[2738]] [debug_and_log] (0x0020): [RID#485] 2587: [13][Permission denied] (2026-06-04 15:55:33): [krb5_child[2738]] [debug_and_log] (0x0040): [RID#485] 2677: [13][Permission denied] * ... skipping repetitive backtrace ... Running a kinit <user> works as expected. I don't experience any network latency. Disabling TGT validation (krb5_validate = false) "fixes" it. With Fedora 43 (SSSD 2.12.0), it was relatively rare. Since the update to Fedora 44 (SSSD 2.13.0), this problem has become much more prevalent. It

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users June 2026