Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
+++ This bug was initially created as a clone of Bug #1970168 +++
[root@ipaserver ~]# echo "vagrant" | ipa trust-add --type=ad ad.test --admin vagrant --password --two-way=true
ipa: ERROR: CIFS server communication error: code "3221225495", message "{Not Enough Quota} Not enough virtual memory or paging file quota is available to complete the specified operation." (both may be "None")
[root@ipaserver ~]#
Injecting a stack print, the callsite is:
File "/usr/share/ipa/wsgi.py", line 59, in application
return api.Backend.wsgi_dispatch(environ, start_response)
File "/usr/lib/python3.9/site-packages/ipaserver/rpcserver.py", line 296, in __call__
return self.route(environ, start_response)
File "/usr/lib/python3.9/site-packages/ipaserver/rpcserver.py", line 308, in route
return app(environ, start_response)
File "/usr/lib/python3.9/site-packages/ipaserver/rpcserver.py", line 917, in __call__
response = super(jsonserver_session, self).__call__(environ, start_response)
File "/usr/lib/python3.9/site-packages/ipaserver/rpcserver.py", line 517, in __call__
response = super(jsonserver, self).__call__(environ, start_response)
File "/usr/lib/python3.9/site-packages/ipaserver/rpcserver.py", line 473, in __call__
response = self.wsgi_execute(environ)
File "/usr/lib/python3.9/site-packages/ipaserver/rpcserver.py", line 400, in wsgi_execute
result = command(*args, **options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 471, in __call__
return self.__do_call(*args, **options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 499, in __do_call
ret = self.run(*args, **options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 821, in run
return self.execute(*args, **options)
File "/usr/lib/python3.9/site-packages/ipaserver/plugins/trust.py", line 759, in execute
full_join = self.validate_options(*keys, **options)
File "/usr/lib/python3.9/site-packages/ipaserver/plugins/trust.py", line 868, in validate_options
self.trustinstance = ipaserver.dcerpc.TrustDomainJoins(self.api)
File "/usr/lib/python3.9/site-packages/ipaserver/dcerpc.py", line 1742, in __init__
self.__populate_local_domain()
File "/usr/lib/python3.9/site-packages/ipaserver/dcerpc.py", line 1756, in __populate_local_domain
ld.retrieve(FQDN)
File "/usr/lib/python3.9/site-packages/ipaserver/dcerpc.py", line 992, in retrieve
self.init_lsa_pipe(remote_host)
File "/usr/lib/python3.9/site-packages/ipaserver/dcerpc.py", line 891, in init_lsa_pipe
self._pipe = self.__gen_lsa_connection(binding)
File "/usr/lib/python3.9/site-packages/ipaserver/dcerpc.py", line 870, in __gen_lsa_connection
raise assess_dcerpc_error(e)
File "/usr/lib/python3.9/site-packages/ipaserver/dcerpc.py", line 179, in assess_dcerpc_error
traceback.print_stack(file=f)
I've previously captured an strace, but it doesn't seem helpful: https://rharwood.fedorapeople.org/strace
I observe no network traffic on any interface, other than: DNS, STP, SSH, LDAP, and HTTPS (on 443).
Tarball of debug logs with debug level 50: https://rharwood.fedorapeople.org/var_log_samba.tar.gz
Should you reproduce this locally, I have a repo: https://github.com/frozencemetery/ad-testing/ (vagrant up ipaserver, vagrant ssh ipaserver, sudo ./install_trust.sh).
I'm personally at a loss as to how to debug this further. I don't seem to be able to find where the lsa stuff comes from, and no matter which smbd I attach to with gdb (even all of them), I can't seem to catch the connection. Is it possible that there is no connection, somehow?
--- Additional comment from Andreas Schneider on 2021-07-14 10:03:57 UTC ---
Error loading module '/usr/lib64/samba/idmap/sss.so': /usr/lib64/samba/idmap/sss.so: cannot open shared object file: No such file or directory
looks like idmap_sss is not installed and it can't allocate IDs ...
--- Additional comment from Alexander Bokovoy on 2021-07-14 10:05:02 UTC ---
sssd-winbind-idmap is missing in IPA dependencies, it looks like.
Comment 1Florence Blanc-Renaud
2021-07-15 14:30:51 UTC