I have a number of systems all on CentOS 6.5 with sssd-1.9.2 and had been using enumerate = True to support SLURM. After bringing ~300 nodes online all with enumeration enabled, I found my LDAP server was getting hit hard every 5 minutes. We've opted to disable enumeration, but since then all group membership lookups are failing.

$getent group general

The sssd_LDAP.log shows:

(Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_connect_done] (0x0080): START TLS result: Success(0), Start TLS request accepted.Server willing to negotiate SSL.

(Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_get_server_opts_from_rootdse] (0x0200): No known USN scheme is supported by this server!

(Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Protocol error(2), A dereference attribute must have DN syntax

(Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_deref_search_done] (0x0040): dereference processing failed [5]: Input/output error

(Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_nested_group_deref_direct_done] (0x0020): Error processing direct membership [5]: Input/output error

(Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_nested_done] (0x0020): Nested group processing failed: [5][Input/output error]

(Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_id_op_done] (0x0200): communication error on cached connection, moving to next server

If I re-enable enumeration, "getent group" works with just fine. If I do a "id" on a user account, their primary group just shows the GID, no group name which is breaking numerous applications. As a test I upgraded a dev system to sssd-1.11.6 based on this bug report, https://bugzilla.redhat.com/show_bug.cgi?id=1109188. However the issue persists. I've cleared caches and the result is the same.

The LDAP servers are 389ds version 1.2.11.15-32.el6.

Below is my sssd.conf. What else can be done to debug this or resolve this issue?

Thanks,

- Trey

[sssd]

config_file_version = 2

debug_level = 0x02F0

reconnection_retries = 3

sbus_timeout = 30

services = nss,pam,sudo,ssh

domains = LDAP

[nss]

debug_level = 0x02F0

reconnection_retries = 3

filter_groups = root,wheel

filter_users = root

[pam]

debug_level = 0x02F0

reconnection_retries = 3

offline_credentials_expiration = 0

[sudo]

[ssh]

[domain/LDAP]

debug_level = 0x02F0

cache_credentials = TRUE

entry_cache_timeout = 6000

enumerate = FALSE

id_provider = ldap

auth_provider = ldap

chpass_provider = ldap

access_provider = ldap

sudo_provider = ldap

ldap_uri = ldap://ldap01.DOMAIN,ldap://ldap02.DOMAIN

ldap_search_base = <OMIT>

ldap_network_timeout = 3

ldap_tls_reqcert = demand

ldap_tls_cacert = /etc/pki/tls/certs/puppet-ca.crt

ldap_schema = rfc2307bis

ldap_id_use_start_tls = TRUE

ldap_chpass_update_last_change = TRUE

ldap_group_member = uniquemember

ldap_group_object_class = posixGroup

ldap_group_name = cn

ldap_pwd_policy = none

ldap_account_expire_policy = 389ds

ldap_access_order = filter,expire

ldap_access_filter = (objectclass=posixaccount)

ldap_sudo_search_base = ou=SUDOers,<OMIT>

Thanks,

- Trey