11:14 p.m.
Hello, I was using previously sssd to authenticate my user using id_provider = LDAP and it
works great.
Now that my samba 4 DC is configured and that the GPO can finally be used, I reconfigured
sssd with realmd to be able to use sssd-ad to centralize the authentification for some
services via the GPO.
SSSD was configured automatically by realm as expected and the server is registrer in the
appropriate OU as define in /etc/realmd.conf in my DC. I can also successfully retrieve
my users/group info with getent and id.
Following the example presented here
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration, I notice that
when I try to authenticate a user with SSH I can see errors relative to the retrieve of
the GPO http://pastebin.com/6wzXUrCr
Here is my sssd,confconfiguration:
[sssd]
config_file_version = 2
services = nss, pam
domains = hq.mydc.com
[nss]
# Ensure that certain users are not authenticated from network accounts
filter_users =
root,lightdm,nslcd,dnsmasq,dbus,avahi,avahi-autoipd,backup,beagleindex,bin,daemon,games,gdm,gnats,haldaemon,hplip,irc,ivman,klog,libuuid,list,lp,mail,man,messagebus,mysql,news,ntp,openldap,polkituser,proxy,pulse,puppet,saned,sshd,sync,sys,syslog,uucp,vde2-net,www-data
filter_groups = root
[pam]
[domain/hq.mydc.com]
<----------------------- this part was generated automatically
debug_level = 9
ad_domain = hq.mydc.com
krb5_realm = HQ.mydc.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = ad
Does sssd need to mount/access to the sysvol folder somehow ? Did I missed something in
the configuration of sssd ?
Looking forward for some help ,thanks by advance.
2:40 a.m.
On Wed, Apr 20, 2016 at 04:14:49AM -0000, rolla.matthieu(a)gmail.com wrote:
Hello, I was using previously sssd to authenticate my user using
id_provider = LDAP and it works great.
Now that my samba 4 DC is configured and that the GPO can finally be used, I reconfigured
sssd with realmd to be able to use sssd-ad to centralize the authentification for some
services via the GPO.
SSSD was configured automatically by realm as expected and the server is registrer in the
appropriate OU as define in /etc/realmd.conf in my DC. I can also successfully retrieve
my users/group info with getent and id.
Following the example presented here
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration, I notice that
when I try to authenticate a user with SSH I can see errors relative to the retrieve of
the GPO http://pastebin.com/6wzXUrCr
Can you check/send the gpo_child log file as well?
bye,
Sumit
>
>
> Here is my sssd,confconfiguration:
>
> [sssd]
> config_file_version = 2
> services = nss, pam
> domains = hq.mydc.com
>
> [nss]
> # Ensure that certain users are not authenticated from network accounts
> filter_users =
root,lightdm,nslcd,dnsmasq,dbus,avahi,avahi-autoipd,backup,beagleindex,bin,daemon,games,gdm,gnats,haldaemon,hplip,irc,ivman,klog,libuuid,list,lp,mail,man,messagebus,mysql,news,ntp,openldap,polkituser,proxy,pulse,puppet,saned,sshd,sync,sys,syslog,uucp,vde2-net,www-data
> filter_groups = root
>
> [pam]
>
> [domain/hq.mydc.com]
<----------------------- this part was generated automatically
> debug_level = 9
> ad_domain = hq.mydc.com
> krb5_realm = HQ.mydc.COM
> realmd_tags = manages-system joined-with-samba
> cache_credentials = True
> id_provider = ad
> krb5_store_password_if_offline = True
> default_shell = /bin/bash
> ldap_id_mapping = True
> use_fully_qualified_names = True
> fallback_homedir = /home/%d/%u
> access_provider = ad
>
>
>
> Does sssd need to mount/access to the sysvol folder somehow ? Did I missed something
in the configuration of sssd ?
>
> Looking forward for some help ,thanks by advance.
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
5:11 a.m.
Hello,
Thank you for your answer. The file gpo_child is empty :
root@gtw-template:/var/log/sssd# ls -ltr
total 14656
-rw------- 1 root root 0 Apr 19 21:44 gpo_child.log
-rw------- 1 root root 3050 Apr 19 23:16 sssd_pam.log
-rw------- 1 root root 3050 Apr 19 23:16 sssd_nss.log
-rw------- 1 root root 21970 Apr 19 23:22 sssd.log
-rw------- 1 root root 49771 Apr 19 23:22 ldap_child.log
-rw------- 1 root root 112878 Apr 19 23:22 krb5_child.log
-rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
Do you want me to attach an other one ?
Thank you by advance.
6:39 a.m.
On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
Hello,
Thank you for your answer. The file gpo_child is empty :
root@gtw-template:/var/log/sssd# ls -ltr
total 14656
-rw------- 1 root root 0 Apr 19 21:44 gpo_child.log
-rw------- 1 root root 3050 Apr 19 23:16 sssd_pam.log
-rw------- 1 root root 3050 Apr 19 23:16 sssd_nss.log
-rw------- 1 root root 21970 Apr 19 23:22 sssd.log
-rw------- 1 root root 49771 Apr 19 23:22 ldap_child.log
-rw------- 1 root root 112878 Apr 19 23:22 krb5_child.log
-rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
Do you want me to attach an other one ?
No, I just realized that the error happens even before the child is
called. It looks like some unexpected data is received.
I wonder if you can try to following using gdb after installing the sssd
debuginfo file?
gdb -p $(pidof sssd_be)
(gdb) break ad_gpo_parse_machine_ext_names
(gdb) continue
try to authenticate while keeping gdb running, whenever gdb show the
prompt again please type
(gdb) bt full
(gdb) continue
until the authentication finally fails. Please send me the gdb output.
If this won't work for you I can try to prepare an instrumented build
for you which writes the needed data into the logs. For this I need to
know the exact version of the SSSD package you are using.
bye,
Sumit
Thank you by advance.
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
8:54 a.m.
Hello,
I think the problem come from my DC and the GPO part. I can install a
windows DC to perform test, would you recommend 2008 or 2012 ?
Thanks by advance.
On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com> wrote:
On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
> Hello,
>
> Thank you for your answer. The file gpo_child is empty :
>
> root@gtw-template:/var/log/sssd# ls -ltr
> total 14656
> -rw------- 1 root root 0 Apr 19 21:44 gpo_child.log
> -rw------- 1 root root 3050 Apr 19 23:16 sssd_pam.log
> -rw------- 1 root root 3050 Apr 19 23:16 sssd_nss.log
> -rw------- 1 root root 21970 Apr 19 23:22 sssd.log
> -rw------- 1 root root 49771 Apr 19 23:22 ldap_child.log
> -rw------- 1 root root 112878 Apr 19 23:22 krb5_child.log
> -rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
>
> Do you want me to attach an other one ?
No, I just realized that the error happens even before the child is
called. It looks like some unexpected data is received.
I wonder if you can try to following using gdb after installing the sssd
debuginfo file?
gdb -p $(pidof sssd_be)
(gdb) break ad_gpo_parse_machine_ext_names
(gdb) continue
try to authenticate while keeping gdb running, whenever gdb show the
prompt again please type
(gdb) bt full
(gdb) continue
until the authentication finally fails. Please send me the gdb output.
If this won't work for you I can try to prepare an instrumented build
for you which writes the needed data into the logs. For this I need to
know the exact version of the SSSD package you are using.
bye,
Sumit
>
> Thank you by advance.
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
10:43 a.m.
On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
Hello,
I think the problem come from my DC and the GPO part. I can install a
That's what I'm thinking too. But I expect that the response from your DC
is valid but unexpected by SSSD. So it would be good to see what data
the DC returned which SSSD failed to parse. The gdb steps below should
show this data. If you prefer to just run a test build with additional
debug output please let me know which version you currently use.
windows DC to perform test, would you recommend 2008 or 2012 ?
I think it is not necessary to perform additional tests here.
bye,
Sumit
Thanks by advance.
On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com> wrote:
> On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
> > Hello,
> >
> > Thank you for your answer. The file gpo_child is empty :
> >
> > root@gtw-template:/var/log/sssd# ls -ltr
> > total 14656
> > -rw------- 1 root root 0 Apr 19 21:44 gpo_child.log
> > -rw------- 1 root root 3050 Apr 19 23:16 sssd_pam.log
> > -rw------- 1 root root 3050 Apr 19 23:16 sssd_nss.log
> > -rw------- 1 root root 21970 Apr 19 23:22 sssd.log
> > -rw------- 1 root root 49771 Apr 19 23:22 ldap_child.log
> > -rw------- 1 root root 112878 Apr 19 23:22 krb5_child.log
> > -rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
> >
> > Do you want me to attach an other one ?
>
> No, I just realized that the error happens even before the child is
> called. It looks like some unexpected data is received.
>
> I wonder if you can try to following using gdb after installing the sssd
> debuginfo file?
>
> gdb -p $(pidof sssd_be)
> (gdb) break ad_gpo_parse_machine_ext_names
> (gdb) continue
>
> try to authenticate while keeping gdb running, whenever gdb show the
> prompt again please type
>
> (gdb) bt full
> (gdb) continue
>
> until the authentication finally fails. Please send me the gdb output.
>
> If this won't work for you I can try to prepare an instrumented build
> for you which writes the needed data into the logs. For this I need to
> know the exact version of the SSSD package you are using.
>
> bye,
> Sumit
>
> >
> > Thank you by advance.
>
> > _______________________________________________
> > sssd-users mailing list
> > sssd-users(a)lists.fedorahosted.org
> >
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
>
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
12:16 a.m.
Hello,
I use debian jessy with the testing package for sssd as I did not find a
version in the backport above 1.12, as I need the GPO functionnality.
The debuginfo seems to be available only with RPM.
However, I configured a 2012 DC and got other issue, some that I could fix
but I got similar situation with the GPO.
I decided to installed a Centos 7 with sssd and the GPO are working fine.
I will give a try and build a VM with a new DC with samba 4. Maybe it will
be better wilt the centos 7.
Just one question, I can authenticate with user@domain, is there a way to
omit the suffix ( @domain ) ?
thanks by advance.
On Wed, Apr 20, 2016 at 5:43 PM, Sumit Bose <sbose(a)redhat.com> wrote:
On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
> Hello,
>
> I think the problem come from my DC and the GPO part. I can install a
That's what I'm thinking too. But I expect that the response from your DC
is valid but unexpected by SSSD. So it would be good to see what data
the DC returned which SSSD failed to parse. The gdb steps below should
show this data. If you prefer to just run a test build with additional
debug output please let me know which version you currently use.
> windows DC to perform test, would you recommend 2008 or 2012 ?
I think it is not necessary to perform additional tests here.
bye,
Sumit
>
> Thanks by advance.
>
> On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com> wrote:
>
> > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
> > > Hello,
> > >
> > > Thank you for your answer. The file gpo_child is empty :
> > >
> > > root@gtw-template:/var/log/sssd# ls -ltr
> > > total 14656
> > > -rw------- 1 root root 0 Apr 19 21:44 gpo_child.log
> > > -rw------- 1 root root 3050 Apr 19 23:16 sssd_pam.log
> > > -rw------- 1 root root 3050 Apr 19 23:16 sssd_nss.log
> > > -rw------- 1 root root 21970 Apr 19 23:22 sssd.log
> > > -rw------- 1 root root 49771 Apr 19 23:22 ldap_child.log
> > > -rw------- 1 root root 112878 Apr 19 23:22 krb5_child.log
> > > -rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
> > >
> > > Do you want me to attach an other one ?
> >
> > No, I just realized that the error happens even before the child is
> > called. It looks like some unexpected data is received.
> >
> > I wonder if you can try to following using gdb after installing the
sssd
> > debuginfo file?
> >
> > gdb -p $(pidof sssd_be)
> > (gdb) break ad_gpo_parse_machine_ext_names
> > (gdb) continue
> >
> > try to authenticate while keeping gdb running, whenever gdb show the
> > prompt again please type
> >
> > (gdb) bt full
> > (gdb) continue
> >
> > until the authentication finally fails. Please send me the gdb output.
> >
> > If this won't work for you I can try to prepare an instrumented build
> > for you which writes the needed data into the logs. For this I need to
> > know the exact version of the SSSD package you are using.
> >
> > bye,
> > Sumit
> >
> > >
> > > Thank you by advance.
> >
> > > _______________________________________________
> > > sssd-users mailing list
> > > sssd-users(a)lists.fedorahosted.org
> > >
> >
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> > _______________________________________________
> > sssd-users mailing list
> > sssd-users(a)lists.fedorahosted.org
> >
> >
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> >
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
1:28 a.m.
Solved.
On Thu, Apr 21, 2016 at 7:16 AM, Rolla Matthieu <rolla.matthieu(a)gmail.com>
wrote:
Hello,
I use debian jessy with the testing package for sssd as I did not find a
version in the backport above 1.12, as I need the GPO functionnality.
The debuginfo seems to be available only with RPM.
However, I configured a 2012 DC and got other issue, some that I could fix
but I got similar situation with the GPO.
I decided to installed a Centos 7 with sssd and the GPO are working fine.
I will give a try and build a VM with a new DC with samba 4. Maybe it will
be better wilt the centos 7.
Just one question, I can authenticate with user@domain, is there a way to
omit the suffix ( @domain ) ?
thanks by advance.
On Wed, Apr 20, 2016 at 5:43 PM, Sumit Bose <sbose(a)redhat.com> wrote:
> On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
> > Hello,
> >
> > I think the problem come from my DC and the GPO part. I can install a
>
> That's what I'm thinking too. But I expect that the response from your DC
> is valid but unexpected by SSSD. So it would be good to see what data
> the DC returned which SSSD failed to parse. The gdb steps below should
> show this data. If you prefer to just run a test build with additional
> debug output please let me know which version you currently use.
>
> > windows DC to perform test, would you recommend 2008 or 2012 ?
>
> I think it is not necessary to perform additional tests here.
>
> bye,
> Sumit
>
> >
> > Thanks by advance.
> >
> > On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com> wrote:
> >
> > > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
> > > > Hello,
> > > >
> > > > Thank you for your answer. The file gpo_child is empty :
> > > >
> > > > root@gtw-template:/var/log/sssd# ls -ltr
> > > > total 14656
> > > > -rw------- 1 root root 0 Apr 19 21:44 gpo_child.log
> > > > -rw------- 1 root root 3050 Apr 19 23:16 sssd_pam.log
> > > > -rw------- 1 root root 3050 Apr 19 23:16 sssd_nss.log
> > > > -rw------- 1 root root 21970 Apr 19 23:22 sssd.log
> > > > -rw------- 1 root root 49771 Apr 19 23:22 ldap_child.log
> > > > -rw------- 1 root root 112878 Apr 19 23:22 krb5_child.log
> > > > -rw------- 1 root root 14800060 Apr 20 00:33 sssd_hq.mydc.com.log
> > > >
> > > > Do you want me to attach an other one ?
> > >
> > > No, I just realized that the error happens even before the child is
> > > called. It looks like some unexpected data is received.
> > >
> > > I wonder if you can try to following using gdb after installing the
> sssd
> > > debuginfo file?
> > >
> > > gdb -p $(pidof sssd_be)
> > > (gdb) break ad_gpo_parse_machine_ext_names
> > > (gdb) continue
> > >
> > > try to authenticate while keeping gdb running, whenever gdb show the
> > > prompt again please type
> > >
> > > (gdb) bt full
> > > (gdb) continue
> > >
> > > until the authentication finally fails. Please send me the gdb output.
> > >
> > > If this won't work for you I can try to prepare an instrumented build
> > > for you which writes the needed data into the logs. For this I need to
> > > know the exact version of the SSSD package you are using.
> > >
> > > bye,
> > > Sumit
> > >
> > > >
> > > > Thank you by advance.
> > >
> > > > _______________________________________________
> > > > sssd-users mailing list
> > > > sssd-users(a)lists.fedorahosted.org
> > > >
> > >
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> > > _______________________________________________
> > > sssd-users mailing list
> > > sssd-users(a)lists.fedorahosted.org
> > >
> > >
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> > >
>
> > _______________________________________________
> > sssd-users mailing list
> > sssd-users(a)lists.fedorahosted.org
> >
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
>
2:41 a.m.
On Thu, Apr 21, 2016 at 08:28:21AM +0200, Rolla Matthieu wrote:
Solved.
Everything?
bye,
Sumit
On Thu, Apr 21, 2016 at 7:16 AM, Rolla Matthieu <rolla.matthieu(a)gmail.com>
wrote:
> Hello,
>
> I use debian jessy with the testing package for sssd as I did not find a
> version in the backport above 1.12, as I need the GPO functionnality.
>
> The debuginfo seems to be available only with RPM.
>
> However, I configured a 2012 DC and got other issue, some that I could fix
> but I got similar situation with the GPO.
>
> I decided to installed a Centos 7 with sssd and the GPO are working fine.
> I will give a try and build a VM with a new DC with samba 4. Maybe it will
> be better wilt the centos 7.
>
> Just one question, I can authenticate with user@domain, is there a way to
> omit the suffix ( @domain ) ?
>
>
>
> thanks by advance.
>
>
> On Wed, Apr 20, 2016 at 5:43 PM, Sumit Bose <sbose(a)redhat.com> wrote:
>
>> On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
>> > Hello,
>> >
>> > I think the problem come from my DC and the GPO part. I can install a
>>
>> That's what I'm thinking too. But I expect that the response from your
DC
>> is valid but unexpected by SSSD. So it would be good to see what data
>> the DC returned which SSSD failed to parse. The gdb steps below should
>> show this data. If you prefer to just run a test build with additional
>> debug output please let me know which version you currently use.
>>
>> > windows DC to perform test, would you recommend 2008 or 2012 ?
>>
>> I think it is not necessary to perform additional tests here.
>>
>> bye,
>> Sumit
>>
>> >
>> > Thanks by advance.
>> >
>> > On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com>
wrote:
>> >
>> > > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
>> > > > Hello,
>> > > >
>> > > > Thank you for your answer. The file gpo_child is empty :
>> > > >
>> > > > root@gtw-template:/var/log/sssd# ls -ltr
>> > > > total 14656
>> > > > -rw------- 1 root root 0 Apr 19 21:44 gpo_child.log
>> > > > -rw------- 1 root root 3050 Apr 19 23:16 sssd_pam.log
>> > > > -rw------- 1 root root 3050 Apr 19 23:16 sssd_nss.log
>> > > > -rw------- 1 root root 21970 Apr 19 23:22 sssd.log
>> > > > -rw------- 1 root root 49771 Apr 19 23:22 ldap_child.log
>> > > > -rw------- 1 root root 112878 Apr 19 23:22 krb5_child.log
>> > > > -rw------- 1 root root 14800060 Apr 20 00:33
sssd_hq.mydc.com.log
>> > > >
>> > > > Do you want me to attach an other one ?
>> > >
>> > > No, I just realized that the error happens even before the child is
>> > > called. It looks like some unexpected data is received.
>> > >
>> > > I wonder if you can try to following using gdb after installing the
>> sssd
>> > > debuginfo file?
>> > >
>> > > gdb -p $(pidof sssd_be)
>> > > (gdb) break ad_gpo_parse_machine_ext_names
>> > > (gdb) continue
>> > >
>> > > try to authenticate while keeping gdb running, whenever gdb show the
>> > > prompt again please type
>> > >
>> > > (gdb) bt full
>> > > (gdb) continue
>> > >
>> > > until the authentication finally fails. Please send me the gdb
output.
>> > >
>> > > If this won't work for you I can try to prepare an instrumented
build
>> > > for you which writes the needed data into the logs. For this I need
to
>> > > know the exact version of the SSSD package you are using.
>> > >
>> > > bye,
>> > > Sumit
>> > >
>> > > >
>> > > > Thank you by advance.
>> > >
>> > > > _______________________________________________
>> > > > sssd-users mailing list
>> > > > sssd-users(a)lists.fedorahosted.org
>> > > >
>> > >
>> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
>> > > _______________________________________________
>> > > sssd-users mailing list
>> > > sssd-users(a)lists.fedorahosted.org
>> > >
>> > >
>> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
>> > >
>>
>> > _______________________________________________
>> > sssd-users mailing list
>> > sssd-users(a)lists.fedorahosted.org
>> >
>> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
>> _______________________________________________
>> sssd-users mailing list
>> sssd-users(a)lists.fedorahosted.org
>>
>> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
>>
>
>
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
6:41 a.m.
No not with samba 4. Will try now but not what's the benefited of it.
On Thursday, 21 April 2016, Sumit Bose <sbose(a)redhat.com> wrote:
On Thu, Apr 21, 2016 at 08:28:21AM +0200, Rolla Matthieu wrote:
> Solved.
Everything?
bye,
Sumit
>
> On Thu, Apr 21, 2016 at 7:16 AM, Rolla Matthieu <
rolla.matthieu(a)gmail.com <javascript:;>>
> wrote:
>
> > Hello,
> >
> > I use debian jessy with the testing package for sssd as I did not find
a
> > version in the backport above 1.12, as I need the GPO functionnality.
> >
> > The debuginfo seems to be available only with RPM.
> >
> > However, I configured a 2012 DC and got other issue, some that I could
fix
> > but I got similar situation with the GPO.
> >
> > I decided to installed a Centos 7 with sssd and the GPO are working
fine.
> > I will give a try and build a VM with a new DC with samba 4. Maybe it
will
> > be better wilt the centos 7.
> >
> > Just one question, I can authenticate with user@domain, is there a
way to
> > omit the suffix ( @domain ) ?
> >
> >
> >
> > thanks by advance.
> >
> >
> > On Wed, Apr 20, 2016 at 5:43 PM, Sumit Bose <sbose(a)redhat.com
<javascript:;>> wrote:
> >
> >> On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
> >> > Hello,
> >> >
> >> > I think the problem come from my DC and the GPO part. I can install
a
> >>
> >> That's what I'm thinking too. But I expect that the response from
your DC
> >> is valid but unexpected by SSSD. So it would be good to see what data
> >> the DC returned which SSSD failed to parse. The gdb steps below should
> >> show this data. If you prefer to just run a test build with additional
> >> debug output please let me know which version you currently use.
> >>
> >> > windows DC to perform test, would you recommend 2008 or 2012 ?
> >>
> >> I think it is not necessary to perform additional tests here.
> >>
> >> bye,
> >> Sumit
> >>
> >> >
> >> > Thanks by advance.
> >> >
> >> > On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose <sbose(a)redhat.com
<javascript:;>> wrote:
> >> >
> >> > > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu wrote:
> >> > > > Hello,
> >> > > >
> >> > > > Thank you for your answer. The file gpo_child is empty :
> >> > > >
> >> > > > root@gtw-template:/var/log/sssd# ls -ltr
> >> > > > total 14656
> >> > > > -rw------- 1 root root 0 Apr 19 21:44 gpo_child.log
> >> > > > -rw------- 1 root root 3050 Apr 19 23:16 sssd_pam.log
> >> > > > -rw------- 1 root root 3050 Apr 19 23:16 sssd_nss.log
> >> > > > -rw------- 1 root root 21970 Apr 19 23:22 sssd.log
> >> > > > -rw------- 1 root root 49771 Apr 19 23:22 ldap_child.log
> >> > > > -rw------- 1 root root 112878 Apr 19 23:22 krb5_child.log
> >> > > > -rw------- 1 root root 14800060 Apr 20 00:33
sssd_hq.mydc.com.log
> >> > > >
> >> > > > Do you want me to attach an other one ?
> >> > >
> >> > > No, I just realized that the error happens even before the child
is
> >> > > called. It looks like some unexpected data is received.
> >> > >
> >> > > I wonder if you can try to following using gdb after installing
the
> >> sssd
> >> > > debuginfo file?
> >> > >
> >> > > gdb -p $(pidof sssd_be)
> >> > > (gdb) break ad_gpo_parse_machine_ext_names
> >> > > (gdb) continue
> >> > >
> >> > > try to authenticate while keeping gdb running, whenever gdb show
the
> >> > > prompt again please type
> >> > >
> >> > > (gdb) bt full
> >> > > (gdb) continue
> >> > >
> >> > > until the authentication finally fails. Please send me the gdb
output.
> >> > >
> >> > > If this won't work for you I can try to prepare an
instrumented
build
> >> > > for you which writes the needed data into the logs. For this I
need to
> >> > > know the exact version of the SSSD package you are using.
> >> > >
> >> > > bye,
> >> > > Sumit
> >> > >
> >> > > >
> >> > > > Thank you by advance.
> >> > >
> >> > > > _______________________________________________
> >> > > > sssd-users mailing list
> >> > > > sssd-users(a)lists.fedorahosted.org <javascript:;>
> >> > > >
> >> > >
> >>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> >> > > _______________________________________________
> >> > > sssd-users mailing list
> >> > > sssd-users(a)lists.fedorahosted.org <javascript:;>
> >> > >
> >> > >
> >>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> >> > >
> >>
> >> > _______________________________________________
> >> > sssd-users mailing list
> >> > sssd-users(a)lists.fedorahosted.org <javascript:;>
> >> >
> >>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> >> _______________________________________________
> >> sssd-users mailing list
> >> sssd-users(a)lists.fedorahosted.org <javascript:;>
> >>
> >>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> >>
> >
> >
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org <javascript:;>
>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org <javascript:;>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
6:48 a.m.
Hello Sumit,
Please find attach the trace as requested.
I use debian 8 with sernet SAMBA 4 , backend bind_DLZ. POSIX attributs are
active and working.
Regarding SSSD:
It's running on the last Centos 7. here are the packages :
[root@gtwdcsmb ~]# rpm -qa | grep -E "sssd|realm"
sssd-client-1.13.0-40.el7_2.2.x86_64
sssd-common-pac-1.13.0-40.el7_2.2.x86_64
sssd-krb5-1.13.0-40.el7_2.2.x86_64
sssd-debuginfo-1.13.0-40.el7_2.2.x86_64
python-sssdconfig-1.13.0-40.el7_2.2.noarch
sssd-krb5-common-1.13.0-40.el7_2.2.x86_64
sssd-ipa-1.13.0-40.el7_2.2.x86_64
sssd-ldap-1.13.0-40.el7_2.2.x86_64
sssd-proxy-1.13.0-40.el7_2.2.x86_64
realmd-0.16.1-5.el7.x86_64
sssd-common-1.13.0-40.el7_2.2.x86_64
sssd-ad-1.13.0-40.el7_2.2.x86_64
sssd-1.13.0-40.el7_2.2.x86_64
Also, regarding sssd, DNS registration ( forward and reverse ) and the
registration of the computer in a specific OU with realm are working when
sssd is starting. Or when a Machine is joining the Domain.
Currently, Authenfication is working but the GPO are not applicated /
called. Same as prviously, things gpo_child.log is not growing and the GPO
does not seems to be called...
I hope the trace will help you to identify the source of the problem.
As I mention earlier, as a test, I also setup a POC with windows 2012 as
DC. SSSD is working without problem, GPO too.
If you need anything else please let me know and thank for your help.
On Thu, Apr 21, 2016 at 1:41 PM, Rolla Matthieu <rolla.matthieu(a)gmail.com>
wrote:
No not with samba 4. Will try now but not what's the benefited of
it.
On Thursday, 21 April 2016, Sumit Bose <sbose(a)redhat.com> wrote:
> On Thu, Apr 21, 2016 at 08:28:21AM +0200, Rolla Matthieu wrote:
> > Solved.
>
> Everything?
>
> bye,
> Sumit
>
> >
> > On Thu, Apr 21, 2016 at 7:16 AM, Rolla Matthieu <
> rolla.matthieu(a)gmail.com>
> > wrote:
> >
> > > Hello,
> > >
> > > I use debian jessy with the testing package for sssd as I did not
> find a
> > > version in the backport above 1.12, as I need the GPO functionnality.
> > >
> > > The debuginfo seems to be available only with RPM.
> > >
> > > However, I configured a 2012 DC and got other issue, some that I
> could fix
> > > but I got similar situation with the GPO.
> > >
> > > I decided to installed a Centos 7 with sssd and the GPO are working
> fine.
> > > I will give a try and build a VM with a new DC with samba 4. Maybe it
> will
> > > be better wilt the centos 7.
> > >
> > > Just one question, I can authenticate with user@domain, is there a
> way to
> > > omit the suffix ( @domain ) ?
> > >
> > >
> > >
> > > thanks by advance.
> > >
> > >
> > > On Wed, Apr 20, 2016 at 5:43 PM, Sumit Bose <sbose(a)redhat.com>
wrote:
> > >
> > >> On Wed, Apr 20, 2016 at 03:54:46PM +0200, Rolla Matthieu wrote:
> > >> > Hello,
> > >> >
> > >> > I think the problem come from my DC and the GPO part. I can
> install a
> > >>
> > >> That's what I'm thinking too. But I expect that the response
from
> your DC
> > >> is valid but unexpected by SSSD. So it would be good to see what data
> > >> the DC returned which SSSD failed to parse. The gdb steps below
> should
> > >> show this data. If you prefer to just run a test build with
> additional
> > >> debug output please let me know which version you currently use.
> > >>
> > >> > windows DC to perform test, would you recommend 2008 or 2012 ?
> > >>
> > >> I think it is not necessary to perform additional tests here.
> > >>
> > >> bye,
> > >> Sumit
> > >>
> > >> >
> > >> > Thanks by advance.
> > >> >
> > >> > On Wed, Apr 20, 2016 at 1:39 PM, Sumit Bose
<sbose(a)redhat.com>
> wrote:
> > >> >
> > >> > > On Wed, Apr 20, 2016 at 12:11:05PM +0200, Rolla Matthieu
wrote:
> > >> > > > Hello,
> > >> > > >
> > >> > > > Thank you for your answer. The file gpo_child is empty
:
> > >> > > >
> > >> > > > root@gtw-template:/var/log/sssd# ls -ltr
> > >> > > > total 14656
> > >> > > > -rw------- 1 root root 0 Apr 19 21:44
gpo_child.log
> > >> > > > -rw------- 1 root root 3050 Apr 19 23:16
sssd_pam.log
> > >> > > > -rw------- 1 root root 3050 Apr 19 23:16
sssd_nss.log
> > >> > > > -rw------- 1 root root 21970 Apr 19 23:22 sssd.log
> > >> > > > -rw------- 1 root root 49771 Apr 19 23:22
ldap_child.log
> > >> > > > -rw------- 1 root root 112878 Apr 19 23:22
krb5_child.log
> > >> > > > -rw------- 1 root root 14800060 Apr 20 00:33
> sssd_hq.mydc.com.log
> > >> > > >
> > >> > > > Do you want me to attach an other one ?
> > >> > >
> > >> > > No, I just realized that the error happens even before the
child
> is
> > >> > > called. It looks like some unexpected data is received.
> > >> > >
> > >> > > I wonder if you can try to following using gdb after
installing
> the
> > >> sssd
> > >> > > debuginfo file?
> > >> > >
> > >> > > gdb -p $(pidof sssd_be)
> > >> > > (gdb) break ad_gpo_parse_machine_ext_names
> > >> > > (gdb) continue
> > >> > >
> > >> > > try to authenticate while keeping gdb running, whenever gdb
show
> the
> > >> > > prompt again please type
> > >> > >
> > >> > > (gdb) bt full
> > >> > > (gdb) continue
> > >> > >
> > >> > > until the authentication finally fails. Please send me the
gdb
> output.
> > >> > >
> > >> > > If this won't work for you I can try to prepare an
instrumented
> build
> > >> > > for you which writes the needed data into the logs. For this
I
> need to
> > >> > > know the exact version of the SSSD package you are using.
> > >> > >
> > >> > > bye,
> > >> > > Sumit
> > >> > >
> > >> > > >
> > >> > > > Thank you by advance.
> > >> > >
> > >> > > > _______________________________________________
> > >> > > > sssd-users mailing list
> > >> > > > sssd-users(a)lists.fedorahosted.org
> > >> > > >
> > >> > >
> > >>
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> > >> > > _______________________________________________
> > >> > > sssd-users mailing list
> > >> > > sssd-users(a)lists.fedorahosted.org
> > >> > >
> > >> > >
> > >>
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> > >> > >
> > >>
> > >> > _______________________________________________
> > >> > sssd-users mailing list
> > >> > sssd-users(a)lists.fedorahosted.org
> > >> >
> > >>
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> > >> _______________________________________________
> > >> sssd-users mailing list
> > >> sssd-users(a)lists.fedorahosted.org
> > >>
> > >>
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> > >>
> > >
> > >
>
> > _______________________________________________
> > sssd-users mailing list
> > sssd-users(a)lists.fedorahosted.org
> >
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
> https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org
>
2:48 a.m.
On Sat, Apr 23, 2016 at 01:48:54PM +0200, Rolla Matthieu wrote:
Hello Sumit,
Please find attach the trace as requested.
I use debian 8 with sernet SAMBA 4 , backend bind_DLZ. POSIX attributs are
active and working.
Regarding SSSD:
It's running on the last Centos 7. here are the packages :
[root@gtwdcsmb ~]# rpm -qa | grep -E "sssd|realm"
sssd-client-1.13.0-40.el7_2.2.x86_64
sssd-common-pac-1.13.0-40.el7_2.2.x86_64
sssd-krb5-1.13.0-40.el7_2.2.x86_64
sssd-debuginfo-1.13.0-40.el7_2.2.x86_64
python-sssdconfig-1.13.0-40.el7_2.2.noarch
sssd-krb5-common-1.13.0-40.el7_2.2.x86_64
sssd-ipa-1.13.0-40.el7_2.2.x86_64
sssd-ldap-1.13.0-40.el7_2.2.x86_64
sssd-proxy-1.13.0-40.el7_2.2.x86_64
realmd-0.16.1-5.el7.x86_64
sssd-common-1.13.0-40.el7_2.2.x86_64
sssd-ad-1.13.0-40.el7_2.2.x86_64
sssd-1.13.0-40.el7_2.2.x86_64
Also, regarding sssd, DNS registration ( forward and reverse ) and the
registration of the computer in a specific OU with realm are working when
sssd is starting. Or when a Machine is joining the Domain.
SSSD tries to run a dynamic DNS update whenever it goes online, i.e. at
startup and at runtime when the configured servers show up in the
network again.
Currently, Authenfication is working but the GPO are not applicated /
called. Same as prviously, things gpo_child.log is not growing and the GPO
does not seems to be called...
I hope the trace will help you to identify the source of the problem.
As I mention earlier, as a test, I also setup a POC with windows 2012 as
DC. SSSD is working without problem, GPO too.
If you need anything else please let me know and thank for your help.
...
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]]
[ad_gpo_filter_gpos_by_dacl] (0x4000): examining dacl
candidate_gpo_guid:{31B2F340-016D-11D2-945F-00C04FB984F9}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000):
GPO not applicable to target per security filtering
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000):
examining dacl candidate_gpo_guid:{5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000):
GPO applicable to target per security filtering
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_process_gpo_done] (0x0400):
dacl_filtered_gpos[0]->gpo_guid is {5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_cse_guid]
(0x4000): examining cse candidate_gpo_guid: {5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_filter_gpos_by_cse_guid]
(0x4000): GPO applicable to target per cse_guid filtering
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_process_gpo_done] (0x0400):
cse_filtered_gpos[0]->gpo_guid is {5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_process_gpo_done] (0x0400):
num_cse_filtered_gpos: 1
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): start ldb transaction
(nesting: 0)
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_result_object]
(0x4000): cn=gpos,cn=ad,cn=custom,cn=mydc.com,cn=sysdb
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0x7f2f84015c90
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
"ltdb_timeout": 0x7f2f84009f00
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Running timer event
0x7f2f84015c90 "ltdb_callback"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Destroying timer event
0x7f2f84009f00 "ltdb_timeout"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Ending timer event
0x7f2f84015c90 "ltdb_callback"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_result_object]
(0x4000): No GPO Result object.
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): commit ldb transaction
(nesting: 0)
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): cse
filtered_gpos[0]->gpo_guid is {5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x4000):
cse_filtered_gpos[0]->gpo_cse_guids[0]->gpo_guid is
{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): smb_server:
smb://DC02.mydc.com
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): smb_share:
/SysVol
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): smb_path:
/mydc.com/Policies/{5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): gpo_guid:
{5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): retrieving
GPO from cache [{5C320202-3B01-4865-B495-395BD580B315}]
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_by_guid] (0x4000):
cn=gpos,cn=ad,cn=custom,cn=mydc.com,cn=sysdb
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0x7f2f84009f80
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Added timed event
"ltdb_timeout": 0x7f2f8400b290
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Running timer event
0x7f2f84009f80 "ltdb_callback"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Destroying timer event
0x7f2f8400b290 "ltdb_timeout"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ldb] (0x4000): Ending timer event
0x7f2f84009f80 "ltdb_callback"
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sysdb_gpo_get_gpo_by_guid] (0x4000): No
such entry.
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400): ENOENT
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400):
send_to_child: 1
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_step] (0x0400):
cached_gpt_version: -1
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [create_cse_send_buffer] (0x4000): buffer
size: 158
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_handler_setup] (0x2000): Setting
up signal handler up for pid [4243]
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_handler_setup] (0x2000): Signal
handler set up for pid [4243]
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sdap_process_result] (0x2000): Trace:
sh[0x7f2f83fcae70], connected[1], ops[(nil)], ldap[0x7f2f83f91be0]
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [sdap_process_result] (0x2000): Trace:
ldap_result found nothing!
(Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [write_pipe_handler] (0x0400): All data
has been sent!
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0400): gpo_child started.
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0400): context
initialized
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x0400):
cached_gpt_version: -1
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_server
length: 22
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000):
smb_server: smb://DC02.mydc.com
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_share
length: 7
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_share:
/SysVol
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_path
length: 60
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000): smb_path:
/mydc.com/Policies/{5C320202-3B01-4865-B495-395BD580B315}
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000):
smb_cse_suffix length: 49
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [unpack_buffer] (0x4000):
smb_cse_suffix: /Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0400): performing smb
operations
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [copy_smb_file_to_gpo_cache]
(0x0400): smb_uri:
smb://DC02.mydc.com/SysVol/mydc.com/Policies/{5C320202-3B01-4865-B495-395...
(Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [copy_smb_file_to_gpo_cache]
(0x0020): smbc_getFunctionOpen failed [2][No such file or directory]
If I understood it correctly DC02.mydc.com is a Samba4 DC. Does it
provide a SysVol share which contains the gpo file
/mydc.com/Policies/{5C320202-3B01-4865-B495-395BD580B315}/GPT.INI ?
bye,
Sumit
> (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [perform_smb_operations]
(0x0020): copy_smb_file_to_gpo_cache failed [2][No such file or directory]
> (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0020):
perform_smb_operations failed.[2][No such file or directory].
> (Sat Apr 23 13:44:09 2016) [[sssd[gpo_child[4243]]]] [main] (0x0020): gpo_child
failed!
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [read_pipe_handler] (0x0400): EOF
received, client finished
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [gpo_cse_done] (0x0020):
ad_gpo_parse_gpo_child_response failed: [22][Invalid argument]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_done] (0x0400): gpo_guid:
{5C320202-3B01-4865-B495-395BD580B315}
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_cse_done] (0x0040): Unable to
retrieve policy data: [22](Invalid argument}
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_access_done] (0x0040):
GPO-based access control failed.
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [ad_gpo_access_done] (0x0040):
Ignoring error: [22](Invalid argument); GPO-based access control failed, but GPO is not in
enforcing mode.
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0100):
Backend returned: (0, 0, <NULL>) [Success (Success)]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0400):
SELinux provider doesn't exist, not sending the request to it.
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0100):
Sending result [0][mydc.COM]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [be_pam_handler_callback] (0x0100):
Sent result [0][mydc.COM]
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_sig_handler] (0x1000): Waiting
for child [4243].
> (Sat Apr 23 13:44:09 2016) [sssd[be[mydc.com]]] [child_sig_handler] (0x0020): child
[4243] failed with status [1].
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [sbus_remove_timeout] (0x2000):
0x7ffaccc16a20
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn:
0x7ffaccc0f810
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching.
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [pam_dp_process_reply] (0x0200): received: [0
(Success)][mydc.COM]
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with
result [0]: Success.
> (Sat Apr 23 13:44:09 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 28
4:47 a.m.
So I think the problem is persisting. I managed to make work samba 4 as a DC with full
replication.
When starting sssd even the dns update is working against samba 4 bind_dlz backend.
However the GPO are still skipped.
Regarding the configuration, I changed it a bit :
[sssd]
domains = mydc.com
config_file_version = 2
services = nss, pam
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/mydc.com]
debug_level = 10
ldap_schema = ad
ad_domain = mydc.com
dyndns_server = dc01.mydc.com
ad_server = dc01.unity3d.com
krb5_realm = UNITY3D.COM
ad_gpo_access_control = enforcing
ad_gpo_map_service = +openvpn
#krb5_use_enterprise_principal = false
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
access_provider = ad
By specifying AD for ldap_scheme (as I use samba4 sernet), now I can found my users
correctly using POSIX. I also manage by setting "us_fully_quilifield_names" to
False to get a proper list of the groups for a users or when checking with "id"
command.example :
[user3@gtwdcsmb ~]$ id
uid=15001(user3) gid=10000(domain users) groups=10000(domain users),10004(not_allow)
[user3@gtwdcsmb ~]$
Here is the Debug as requested, you will also fin the log associated. I recreated them
before doing the dbg
dbg as requested : http://pastebin.com/usijYbFE
log associated :
[root@gtwdcsmb sssd]# ls -ltr
total 492
-rw------- 1 root root 15766 Apr 24 11:27 ldap_child.log
-rw------- 1 root root 15015 Apr 24 11:27 krb5_child.log
-rw------- 1 root root 0 Apr 24 11:27 gpo_child.log
-rw------- 1 root root 128 Apr 24 11:29 sssd.log
-rw------- 1 root root 826 Apr 24 11:32 sssd_pam.log
-rw------- 1 root root 826 Apr 24 11:32 sssd_nss.log
-rw------- 1 root root 255234 Apr 24 11:33 sssd_mydc.com.log
ldap_child.log : http://pastebin.com/3qk2RPma
krb5_child.log : http://pastebin.com/5GDskCJN
gpo_child.log : empty
sssd_mydc.com.log : http://pastebin.com/4yHUXRZ3
Here is the version that I use :
The VM with SSSD :
[root@gtwdcsmb sssd]# uname -a
Linux gtwdcsmb.unity3d.com 3.10.0-327.13.1.el7.x86_64 #1 SMP Thu Mar 31 16:04:38 UTC 2016
x86_64 x86_64 x86_64 GNU/Linux
[root@gtwdcsmb sssd]# cat /etc/redhat-release
CentOS Linux release 7.2.1511 (Core)
[root@gtwdcsmb sssd]# rpm -qa | grep sssd
sssd-client-1.13.0-40.el7_2.2.x86_64
sssd-common-pac-1.13.0-40.el7_2.2.x86_64
sssd-krb5-1.13.0-40.el7_2.2.x86_64
python-sssdconfig-1.13.0-40.el7_2.2.noarch
sssd-krb5-common-1.13.0-40.el7_2.2.x86_64
sssd-ipa-1.13.0-40.el7_2.2.x86_64
sssd-ldap-1.13.0-40.el7_2.2.x86_64
sssd-proxy-1.13.0-40.el7_2.2.x86_64
sssd-common-1.13.0-40.el7_2.2.x86_64
sssd-ad-1.13.0-40.el7_2.2.x86_64
sssd-1.13.0-40.el7_2.2.x86_64
sssd-debuginfo-1.13.0-40.el7_2.2.x86_64
The VM with Samba:
root@dc01:~# cat /etc/debian_version
8.4
root@dc01:~# uname -a
Linux dc01 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt25-2 (2016-04-08) x86_64 GNU/Linux
root@dc01:~# dpkg -l |grep samba
ii libwbclient0:amd64 99:4.3.8-11 amd64 Glue package
for sernet-samba-libs.
ii samba-common 99:4.3.8-11 all Glue package
for sernet-samba-common.
rc samba-libs:amd64 2:4.2.10+dfsg-0+deb8u2 amd64 Samba core
libraries
ii sernet-samba 99:4.3.8-11 amd64 SMB/CIFS
file, print, and login server for Unix
ii sernet-samba-ad 99:4.3.8-11 amd64 Samba Active
Directory Domain Controller
ii sernet-samba-client 99:4.3.8-11 amd64 a
LanManager-like simple client for Unix
ii sernet-samba-common 99:4.3.8-11 all Samba common
files used by both the server and the client
ii sernet-samba-libs:amd64 99:4.3.8-11 amd64 Samba common
library files used by both the server and the client
ii sernet-samba-libsmbclient0:amd64 99:4.3.8-11 amd64 Shared
library that allows applications to talk to SMB servers
ii sernet-samba-winbind 99:4.3.8-11 amd64 Samba
nameservice integration server
Thanks you again for your help . :D
2920
days inactive
2925
days old
sssd-users@lists.fedorahosted.org
12 comments
2 participants
participants (2)
-
Rolla Matthieu -
Sumit Bose