Bug 2361759
| Summary: | sssd version 2.10.2 forgets group membership information after an hour | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Thomas Clark <fedoraproject> | ||||
| Component: | sssd | Assignee: | sssd-maintainers <sssd-maintainers> | ||||
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 42 | CC: | abokovoy, atikhono, lslebodn, pbrezina, sbose, ssorce, sssd-maintainers | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | --- | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2025-04-23 21:41:06 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Thomas Clark
2025-04-22 20:16:23 UTC
Hi,
would it be possible to add `debug_level = 9` to the [nss] and [domain/...] section, restart SSSD, wait until the issue occurs, call
sss_cache -E
getent group homeassistant
and send the SSSD debug logs?
bye,
Sumit
Created attachment 2086740 [details]
sssd level 9 debug logs
Debug logs during group failure, as requested.
Hi, it looks like you have set `ldap_search_base` in sssd.conf to the baseDN of the IPA server and the compat tree in enabled on the IPA server as well. As a result a search for a user or a group will find two entries, one in the main IPA LDAP tree in `cn=accounts,baseDN` and the other in the compat tree. Is there a reason to set `ldap_search_base`? If not, I would suggest to remove this option from sssd.conf and check if the behavior is more consistent. HTH bye, Sumit I might have had a reason for setting ldap_search_base years ago when I did it. I believe it was related to initial attempts to make autofs work. However, I haven't thought about it in years, and it never would have occurred to me that it could cause this issue. I removed it several hours ago on multiple machines, and none of them has forgotten group members since that time. I believe it's fixed, and I deeply appreciate your help. I still wonder why it worked for years and only recently became a problem, but it probably doesn't really matter. Hi, glad to hear it is working for you. In recent versions of SSSD some performance improvements related to group lookups and processing group members were added. Although I currently cannot point to the exact change which might have led to the change in behavior your are seeing I suspect it is coming from those changes. On the other hand I'm surprised that it was working for you so long before because in general SSSD does not expect that multiple results are returned from an LDAP server when searching for a single user or group. bye, Sumit Hi Sumit, (In reply to Sumit Bose from comment #5) > > In recent versions of SSSD some > performance improvements related to group lookups and processing group > members were added. Although I currently cannot point to the exact change > which might have led to the change in behavior your are seeing I suspect it > is coming from those changes. JFTR: if you mean - https://github.com/SSSD/sssd/pull/7841 - https://github.com/SSSD/sssd/pull/7866 - https://github.com/SSSD/sssd/pull/7872 then none of those were shipped in Fedora yet / not a part of sssd-2.10.2 (or any other upstream release). |