Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm new to SSSD but I think I've configured it correctly considering id {ldap user} returns the expected uid and gid values for multiple test users. I'm using two CentOS 6.4 servers as test machines. One running ApacheDS and the other SSSD. However, when I attempt to login via ssh or directly on the console, using any one of those users, I get access denied. I've spent the last few days pouring over the SSSD logs and I'm not sure where else to look. Rather than include all of the config files I'll just say for now that I ran the following authconfig --enablesssd --enablesssdauth --enablelocauthorize --update on the client server. Check below for my SSSD config and here for SSSD_Default log. Let me know what additional logs you would like to see and I'll pull them ASAP.

Thanks for your help!

cat /etc/sssd/sssd.conf

[sssd]

config_file_version = 2
services = nss, pam
domains = default

debug_level = 4

[nss]

filter_users = root

debug_level = 4

[pam]

debug_level = 4

[domain/default]

debug_level = 4

ldap_tls_reqcert = never
auth_provider = ldap
ldap_schema = rfc2307
ldap_search_base = dc=example,dc=net
#ldap_group_member = memberUid
id_provider = ldap
ldap_id_use_start_tls = True
chpass_provider = ldap
ldap_uri = ldap://sea-ldap-01.app.example.net:10389
cache_credentials = False
ldap_tls_cacertdir = /etc/openldap/certs
ldap_tls_cacert = /etc/openldap/certs/sea-ldap-01.pem
entry_cache_timeout = 600
ldap_network_timeout = 3
#ldap_access_filter =
ldap_user_search_base = ou=people,dc=example,dc=net
ldap_group_search_base = ou=groups,dc=example,dc=net
share|improve this question
    
Thats the problem, even at 10 I can't see any errors. Thanks for the response though. Here is default @ debug 10 –  james8562 Jun 21 '13 at 23:06
    
The contents of /var/log/secure would help too. –  Dennis Kaarsemaker Jun 25 '13 at 13:19
add comment

2 Answers

up vote 2 down vote accepted

According to that log, it looks like SSSD's LDAP provider crashed and had to be restarted. That's why you got access-denied.

See specifically:

(Fri Jun 21 22:42:46 2013) [sssd[be[default]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_BIND]
(Fri Jun 21 22:42:46 2013) [sssd[be[default]]] [simple_bind_done] (0x2000): Server returned control [1.3.6.1.4.1.42.2.27.8.5.1].

and then it goes to

(Fri Jun 21 22:42:46 2013) [sssd[be[default]]] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb
(Fri Jun 21 22:42:46 2013) [sssd[be[default]]] [recreate_ares_channel] (0x0100): Initializing new c-ares channel
(Fri Jun 21 22:42:46 2013) [sssd[be[default]]] [resolv_get_family_order] (0x1000): Lookup order: ipv4_first

Those lines indicate that the server is starting up again. At a guess, I'd say something went wrong while processing the ldap password policy on the client, since the last thing before it crashed was a reference to the LDAP code for the ldap_pwd_exop.

Check /var/log/messages for indications of a crash and file a bug with CentOS. Ideally, install the debuginfo for the sssd, openldap and ding-libs packages, then attach to the sssd_be process with gdb and get a backtrace of the crash to include in the bug report.

share|improve this answer
    
Turns out this was an issue with ApacheDS. After reading your post I decided to try swapping out the back-end and sure enough, changing to openldap allowed my test users to log in. I'll post a bug with ApacheDS. Thanks everyone for helping me get to the bottom of this! –  james8562 Jun 26 '13 at 23:33
add comment

I dont see any errors in the pastebin.. can you set the debug level to 10 (under seed/domain) and capture the logs?

share|improve this answer
    
If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. –  slm Jun 21 '13 at 19:59
    
This would be better as a comment –  Dave M Jun 21 '13 at 20:06
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. –  Dave M Jun 21 '13 at 20:06
    
hmmm... I cant comment on his post.. so no option other than requesting more details though answer box :( –  Najmuddin Jun 24 '13 at 8:19
    
@james8562 Do you see any sssd segfaults during login process, I can see PAM_AUTHENTICATE is called but no progress/errors in the logs, it is possible that SSSD (sss_pam) crashed.. Please check your /var/log/messages and see if any crashes reported. –  Najmuddin Jun 24 '13 at 8:25
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.