Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionPrasad Kulkarni
2014-12-24 12:50:12 UTC
Created attachment 972738[details]
sssd domain logs
Description of problem:
While testing the GPO functionality during a test day, I came across Internal error appearing in the domain logs and denying all users to login.
Note:
Testing on another 7.1 client against the same AD Server seems to work fine. Appropriate users were denied and appropriate users were allowed access.
This could be an issue specific to a system, so I am logging this bug.
Version-Release number of selected component (if applicable):
# rpm -q sssd
sssd-1.12.2-39.el7.x86_64
How reproducible:
Always
Steps to Reproduce:
1. Add a user allowed_user and denied_user to AD.
2. Add the denied_user to "deny log on locally" in the GPO of AD Server.
3. The GPO is set to enforcing.
4. On the client side, the domain has:
[domain/sssdad2012.com]
ad_domain = sssdad2012.com
krb5_realm = SSSDAD2012.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = ad
ad_gpo_access_control = enforcing
debug_level = 9
5. Auth as allowed_user.
Actual results:
# ssh -l allowed_user localhost
allowed_user@localhost's password:
Connection closed by ::1
/var/log/secure shows:
Dec 24 17:55:13 dhcp210-121 sshd[36662]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=allowed_user
Dec 24 17:55:13 dhcp210-121 sshd[36662]: pam_sss(sshd:account): Access denied for user allowed_user: 4 (System error)
Domain log shows(the full domain log is attached):
(Wed Dec 24 17:55:13 2014) [sssd[be[sssdad2012.com]]] [gpo_cse_done] (0x0020): Error in gpo_child: [1852383332][Unknown error 1852383332]
(Wed Dec 24 17:55:13 2014) [sssd[be[sssdad2012.com]]] [ad_gpo_cse_done] (0x0400): gpo_guid: {6723952F-D149-416A-8EE0-7F3C4191A9B0}
(Wed Dec 24 17:55:13 2014) [sssd[be[sssdad2012.com]]] [ad_gpo_cse_done] (0x0040): Unable to retrieve policy data: [1852383332](Unknown error 1852383332}
(Wed Dec 24 17:55:13 2014) [sssd[be[sssdad2012.com]]] [ad_gpo_access_done] (0x0040): GPO-based access control failed.
(Wed Dec 24 17:55:13 2014) [sssd[be[sssdad2012.com]]] [be_pam_handler_callback] (0x0100): Backend returned: (3, 4, Unknown error 1852383332) [Internal Error (System error)]
Expected results:
Additional info:
Removing the option "ad_gpo_access_control = enforcing" from sssd.conf and restarting sssd, allows login to allowed_user:
# ssh -l allowed_user localhost
allowed_user@localhost's password:
Last failed login: Wed Dec 24 17:55:13 IST 2014 from localhost on ssh:notty
There were 8 failed login attempts since the last successful login.
Last login: Wed Dec 24 15:30:07 2014 from localhost
$
Prasad, I left a fixed version of sssd installed on the test machine, feel free to use it to verify the fix or run any additional test cases.
Thank you very much for reporting the problem.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://rhn.redhat.com/errata/RHBA-2015-0441.html
Created attachment 972738 [details] sssd domain logs Description of problem: While testing the GPO functionality during a test day, I came across Internal error appearing in the domain logs and denying all users to login. Note: Testing on another 7.1 client against the same AD Server seems to work fine. Appropriate users were denied and appropriate users were allowed access. This could be an issue specific to a system, so I am logging this bug. Version-Release number of selected component (if applicable): # rpm -q sssd sssd-1.12.2-39.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. Add a user allowed_user and denied_user to AD. 2. Add the denied_user to "deny log on locally" in the GPO of AD Server. 3. The GPO is set to enforcing. 4. On the client side, the domain has: [domain/sssdad2012.com] ad_domain = sssdad2012.com krb5_realm = SSSDAD2012.COM realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = ad ad_gpo_access_control = enforcing debug_level = 9 5. Auth as allowed_user. Actual results: # ssh -l allowed_user localhost allowed_user@localhost's password: Connection closed by ::1 /var/log/secure shows: Dec 24 17:55:13 dhcp210-121 sshd[36662]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=allowed_user Dec 24 17:55:13 dhcp210-121 sshd[36662]: pam_sss(sshd:account): Access denied for user allowed_user: 4 (System error) Domain log shows(the full domain log is attached): (Wed Dec 24 17:55:13 2014) [sssd[be[sssdad2012.com]]] [gpo_cse_done] (0x0020): Error in gpo_child: [1852383332][Unknown error 1852383332] (Wed Dec 24 17:55:13 2014) [sssd[be[sssdad2012.com]]] [ad_gpo_cse_done] (0x0400): gpo_guid: {6723952F-D149-416A-8EE0-7F3C4191A9B0} (Wed Dec 24 17:55:13 2014) [sssd[be[sssdad2012.com]]] [ad_gpo_cse_done] (0x0040): Unable to retrieve policy data: [1852383332](Unknown error 1852383332} (Wed Dec 24 17:55:13 2014) [sssd[be[sssdad2012.com]]] [ad_gpo_access_done] (0x0040): GPO-based access control failed. (Wed Dec 24 17:55:13 2014) [sssd[be[sssdad2012.com]]] [be_pam_handler_callback] (0x0100): Backend returned: (3, 4, Unknown error 1852383332) [Internal Error (System error)] Expected results: Additional info: Removing the option "ad_gpo_access_control = enforcing" from sssd.conf and restarting sssd, allows login to allowed_user: # ssh -l allowed_user localhost allowed_user@localhost's password: Last failed login: Wed Dec 24 17:55:13 IST 2014 from localhost on ssh:notty There were 8 failed login attempts since the last successful login. Last login: Wed Dec 24 15:30:07 2014 from localhost $