Bug 2466974

Summary: SSSD 2.13 doesn't work in offline mode, generates plenty of Permission denied errors
Product: [Fedora] Fedora Reporter: Dmitry <x3v947pl>
Component: sssdAssignee: Pavel Březina <pbrezina>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 44CC: abokovoy, amessina, atikhono, lslebodn, m3freak, pbrezina, sbose, ssorce, sssd-maintainers, zemakacena
Target Milestone: ---Keywords: Regression
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: sssd-2.13.1-1.fc44 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-06-12 00:59:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Dmitry 2026-05-06 09:06:11 UTC 
After upgrading Fedora 43 to 44 windows domain accounts linked via freeipa stopped working in offline mode. Also confirmed that installing fc43 packages of sssd (v.2.12) to fc44 restores normal work. And upgrading them back to fc44 (v.2.13) restores the problem.
Logs are full of:

(2026-05-06 11:54:57): [ssh] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#7] CR #6: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:57): [ssh] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#8] CR #7: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:57): [nss] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#16] CR #140: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:55:00): [nss] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#16] CR #141: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:38): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#3] CR #7: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:57): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#4] CR #11: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:06): [sudo] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#1] CR #0: Data Provider Error: 3, 13, Permission denied
(2026-05-06 11:54:06): [sudo] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#1] CR #1: Data Provider Error: 3, 13, Permission denied
[ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied)
[ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied
[ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied

Disabling selinux doesn't change anything.
If access_provider=permit - same result and errors.
If sssd goes online - everything works ok, no errors. 
Cleaning cache - no effect.
I compared file/forder permissions (/etc/sssd, /var/lib/sss) on fc43 (v2.12) and fc44 (v.2.13) - didn't find any difference.
Checked also on a fresh fc44 installation - same result, if 2.13 - permission denied errors

Reproducible: Always
Comment 1 Alexey Tikhonov 2026-05-06 09:44:10 UTC 
Hi,

(In reply to Dmitry from comment #0)
> [ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied)
> [ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied
> [ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied

Could you please clear /var/log/sssd/*, reproduce an issue and attach sanitized /var/log/sssd/sssd_$domain.log?
Comment 2 Alexey Tikhonov 2026-05-06 09:58:51 UTC 
> > [ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied)
> > [ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied
> > [ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied

Probably it's https://github.com/SSSD/sssd/blob/master/src/providers/ldap/sdap_async_connection.c#L2208
and change introduced by https://github.com/SSSD/sssd/commit/cc42932ac4c58c681d4d928b53f2803bbb9ad277
Comment 3 Dmitry 2026-05-06 10:10:07 UTC 
debug_level = 5

sssd_domain.log:
(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0100): [RID#140] Resetting the status of port 0 for server '(no name)'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_send] (0x0200): [RID#140] The status of SRV lookup is neutral
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_getsrv_send] (0x0100): [RID#140] Trying to resolve SRV record of '_ldap._tcp.ipa.domain.com'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_discover_srv_done] (0x0040): [RID#140] SRV query failed [4]: Domain name not found
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [check_wait_queue] (0x1000): [RID#139] Wait queue for user [aduser1.com] is empty.
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [krb5_auth_queue_done] (0x1000): [RID#139] krb5_auth_queue request [0x55b6e5652ec0] done.
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [dp_req_done] (0x0400): [RID#139] DP Request [PAM Authenticate #139]: Request handler finished [0]: Success
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [_dp_req_recv] (0x0400): [RID#139] DP Request [PAM Authenticate #139]: Receiving request data.
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [dp_req_destructor] (0x0400): [RID#139] DP Request [PAM Authenticate #139]: Request removed.
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [dp_req_destructor] (0x0400): [RID#139] Number of active DP request: 0
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.pamHandler on /sssd from sssd.pam: Success
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [child_sig_handler] (0x1000): [RID#139] Waiting for child [4953].
   *  (2026-05-06 12:57:37): [be[ipa.domain.com]] [child_sig_handler] (0x0100): [RID#139] child [4953] finished successfully.
   *  (2026-05-06 12:58:37): [be[ipa.domain.com]] [be_subdom_reset_status] (0x1000): [RID#137] Resetting subdomain ad.domain.com
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sbus_dispatch] (0x4000): Dispatching.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd from sssd.nss
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.nss]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_attach_req] (0x0400): [RID#140] DP Request [Account #140]: REQ_TRACE: New request. [sssd.nss CID #20] Flags [0x0001].
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_attach_req] (0x0400): [RID#140] Number of active DP request: 1
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_id_op_connect_step] (0x4000): [RID#140] beginning to connect
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_kinit_send] (0x0400): [RID#140] Attempting kinit (default, host/aduser1.vm.ipa.domain.com, ipa.domain.com, 86400)
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_kinit_next_kdc] (0x1000): [RID#140] Resolving next KDC for service IPA
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x1000): [RID#140] Port status of port 0 for server '(no name)' is 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0100): [RID#140] Resetting the status of port 0 for server '(no name)'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_activate_timeout] (0x2000): [RID#140] Resolve timeout [dns_resolver_timeout] set to 6 seconds
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_srv_data_status] (0x0400): [RID#140] Changing state of SRV lookup from 'SRV_RESOLVE_ERROR' to 'SRV_NEUTRAL'.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_send] (0x0200): [RID#140] The status of SRV lookup is neutral
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_discover_srv_next_domain] (0x0400): [RID#140] SRV resolution of service 'ldap'. Will use DNS discovery domain 'ipa.domain.com'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_getsrv_send] (0x0100): [RID#140] Trying to resolve SRV record of '_ldap._tcp.ipa.domain.com'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_request_timeout] (0x2000): [RID#140] Scheduling a timeout of 3 seconds
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_timeout_watcher] (0x2000): [RID#140] Scheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [unschedule_timeout_watcher] (0x4000): [RID#140] Unscheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [request_watch_destructor] (0x0400): [RID#140] Deleting request watch
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_discover_srv_done] (0x0040): [RID#140] SRV query failed [4]: Domain name not found
********************** BACKTRACE DUMP ENDS HERE *********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_set_port_status] (0x0100): [RID#140] Marking port 0 of server '(no name)' as 'not working'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_done] (0x0040): [RID#140] Unable to resolve SRV [1432158237]: SRV record not found
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_set_port_status] (0x0100): [RID#140] Marking port 0 of server '(no name)' as 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_done] (0x0040): [RID#140] Unable to resolve SRV [1432158237]: SRV record not found
********************** BACKTRACE DUMP ENDS HERE *********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [set_srv_data_status] (0x0100): [RID#140] Marking SRV lookup of service 'IPA' as 'not resolved'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x0080): [RID#140] Couldn't resolve server (SRV lookup meta-server), resolver returned [1432158237]: SRV record not found
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x0100): [RID#140] Resetting the server status of 'node4.ipa.domain.com'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#140] Trying to resolve A record of 'node4.ipa.domain.com' in files
(2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status] (0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'resolving name'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#140] Trying to resolve AAAA record of 'node4.ipa.domain.com' in files
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0200): [RID#140] No more address families to retry
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_dns_query] (0x0100): [RID#140] Trying to resolve A record of 'node4.ipa.domain.com' in DNS
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_dns_query] (0x0100): [RID#140] Trying to resolve AAAA record of 'node4.ipa.domain.com' in DNS
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0200): [RID#140] No more address families to retry
(2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0100): [RID#140] No more hosts databases to retry
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_done] (0x0020): [RID#140] Failed to resolve server 'node4.ipa.domain.com': Domain name not found
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_srv_data_status] (0x0100): [RID#140] Marking SRV lookup of service 'IPA' as 'not resolved'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x0080): [RID#140] Couldn't resolve server (SRV lookup meta-server), resolver returned [1432158237]: SRV record not found
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x1000): [RID#140] Trying with the next one!
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000): [RID#140] Status of server 'node4.ipa.domain.com' is 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x0100): [RID#140] Resetting the server status of 'node4.ipa.domain.com'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x1000): [RID#140] Port status of port 0 for server 'node4.ipa.domain.com' is 'neutral'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_activate_timeout] (0x2000): [RID#140] Resolve timeout [dns_resolver_timeout] set to 6 seconds
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000): [RID#140] Status of server 'node4.ipa.domain.com' is 'name not resolved'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_is_unix] (0x4000): [RID#140] [node4.ipa.domain.com] does not look like a unix domain socket
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_is_address] (0x4000): [RID#140] [node4.ipa.domain.com] does not look like an IP address
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step] (0x2000): [RID#140] Querying files
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#140] Trying to resolve A record of 'node4.ipa.domain.com' in files
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status] (0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'resolving name'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step] (0x2000): [RID#140] Querying files
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#140] Trying to resolve AAAA record of 'node4.ipa.domain.com' in files
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0200): [RID#140] No more address families to retry
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step] (0x2000): [RID#140] Querying DNS
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_dns_query] (0x0100): [RID#140] Trying to resolve A record of 'node4.ipa.domain.com' in DNS
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_request_timeout] (0x2000): [RID#140] Scheduling a timeout of 3 seconds
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_timeout_watcher] (0x2000): [RID#140] Scheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [unschedule_timeout_watcher] (0x4000): [RID#140] Unscheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [request_watch_destructor] (0x0400): [RID#140] Deleting request watch
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step] (0x2000): [RID#140] Querying DNS
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_dns_query] (0x0100): [RID#140] Trying to resolve AAAA record of 'node4.ipa.domain.com' in DNS
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_request_timeout] (0x2000): [RID#140] Scheduling a timeout of 3 seconds
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_timeout_watcher] (0x2000): [RID#140] Scheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [unschedule_timeout_watcher] (0x4000): [RID#140] Unscheduling DNS timeout watcher
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [request_watch_destructor] (0x0400): [RID#140] Deleting request watch
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0200): [RID#140] No more address families to retry
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0100): [RID#140] No more hosts databases to retry
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_done] (0x0020): [RID#140] Failed to resolve server 'node4.ipa.domain.com': Domain name not found
********************** BACKTRACE DUMP ENDS HERE *********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status] (0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'not working'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x0080): [RID#140] Couldn't resolve server (node4.ipa.domain.com), resolver returned [11]: Resource temporarily unavailable
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#140] No available servers for service 'IPA'
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status] (0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x0080): [RID#140] Couldn't resolve server (node4.ipa.domain.com), resolver returned [11]: Resource temporarily unavailable
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x1000): [RID#140] Trying with the next one!
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000): [RID#140] Status of server 'node4.ipa.domain.com' is 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x1000): [RID#140] Port status of port 0 for server '(no name)' is 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000): [RID#140] Status of server 'node4.ipa.domain.com' is 'not working'
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#140] No available servers for service 'IPA'
********************** BACKTRACE DUMP ENDS HERE *********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#140] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#140] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#140] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#140] sdap_id_op_connect request failed.
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_id_release_conn_data] (0x4000): [RID#140] Releasing unused connection with fd [-1]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_done] (0x1000): [RID#140] Server [NULL] resolution failed: [5]: Input/output error
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_cli_resolve_and_connect_kinit_done] (0x0400): [RID#140] Cannot get a TGT: ret [1432158230](Network I/O Error)
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_id_op_connect_done] (0x4000): [RID#140] notify error to op #1: 13 [Permission denied]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#140] sdap_id_op_connect request failed.
********************** BACKTRACE DUMP ENDS HERE *********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#141] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#141] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#141] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#141] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#141] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#141] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#141] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#141] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#141] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#141] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#141] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#141] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#141] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=aduser1.com]
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#142] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#142] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#142] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#142] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#142] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#142] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#142] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#142] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#142] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#142] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#142] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#142] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#142] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got request with the following data
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): command: SSS_PAM_PREAUTH
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain: ad.domain.com
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): user: aduser1.com
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): service: plasmalogin
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok type: 0 (No authentication token available)
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available)
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid: 4975
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): child_pid: 0
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon name: not set
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#143] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#143] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#143] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [child_sig_handler] (0x0100): [RID#143] child [4976] finished successfully.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=aduser1.com]
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#144] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#144] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#144] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#144] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#144] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#144] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#144] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#144] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#144] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#144] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#144] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#144] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#144] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got request with the following data
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain: ad.domain.com
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): user: aduser1.com
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): service: plasmalogin
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: 
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok type: 1 (Password)
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available)
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid: 4975
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): child_pid: 0
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon name: not set
(2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#145] Trying to resolve service 'IPA'
(2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#145] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#145] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200): [RID#145] Entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] has set [ts_cache] attrs.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_cache_auth] (0x0100): [RID#145] Authentication failed.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200): [RID#145] Entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] has set [cache, ts_cache] attrs.
(2026-05-06 12:59:01): [be[ipa.domain.com]] [krb5_auth_cache_creds] (0x0020): [RID#145] Offline authentication failed
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_done] (0x1000): [RID#145] Server [NULL] resolution failed: [5]: Input/output error
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_mark_dom_offline] (0x1000): [RID#145] Marking subdomain ad.domain.com offline
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_mark_subdom_offline] (0x4000): [RID#145] Subdomain already inactive
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sss_child_handler_setup] (0x2000): [RID#145] Setting up signal handler up for pid [4977]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sss_child_handler_setup] (0x2000): [RID#145] Signal handler set up for pid [4977]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [_write_pipe_handler] (0x0400): [RID#145] All data has been sent!
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [_read_pipe_handler] (0x4000): [RID#145] Adding [53] bytes of data.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [_read_pipe_handler] (0x0400): [RID#145] All data received
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [parse_krb5_child_response] (0x1000): [RID#145] child response: status code: 0 (Success), msg type: 3 (Env variable to be set with pam_putenv(3)), len: 41
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [krb5_mod_ccname] (0x4000): [RID#145] Save ccname [KEYRING:persistent:1346422211] for user [aduser1.com].
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200): [RID#145] Entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] has set [ts_cache] attrs.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [merge_msg_ts_attrs] (0x2000): [RID#145] No such DN in the timestamp cache: name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#145] TS cache doesn't contain this DN, skipping
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [merge_msg_ts_attrs] (0x2000): [RID#145] No such DN in the timestamp cache: name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#145] TS cache doesn't contain this DN, skipping
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_cache_auth] (0x4000): [RID#145] Offline credentials expiration is [0] days.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [check_failed_login_attempts] (0x4000): [RID#145] Failed login attempts [1], allowed failed login attempts [0], failed login delay [5].
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [check_for_combined_2fa_password] (0x1000): [RID#145] Wrong authtok type.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_cache_auth] (0x0100): [RID#145] Authentication failed.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_ldb_msg_difference] (0x2000): [RID#145] Replaced/extended attr [lastFailedLogin] of entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb]
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200): [RID#145] Entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] has set [cache, ts_cache] attrs.
   *  (2026-05-06 12:59:01): [be[ipa.domain.com]] [krb5_auth_cache_creds] (0x0020): [RID#145] Offline authentication failed
********************** BACKTRACE DUMP ENDS HERE *********************************

(2026-05-06 12:59:01): [be[ipa.domain.com]] [child_sig_handler] (0x0100): [RID#145] child [4977] finished successfully.

sssd_pam/nss.log:
(2026-05-06 12:59:01): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#6] CR #21: Data Provider Error: 3, 13, Permission denied
(2026-05-06 12:59:01): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#6] CR #23: Data Provider Error: 3, 13, Permission denied
Comment 4 Alexey Tikhonov 2026-05-06 10:22:39 UTC 
(In reply to Alexey Tikhonov from comment #2)
> > > [ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied)
> > > [ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied
> > > [ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied
> 
> Probably it's
> https://github.com/SSSD/sssd/blob/master/src/providers/ldap/
> sdap_async_connection.c#L2208

That's it:
```
[sdap_cli_resolve_and_connect_kinit_done] (0x0400): [RID#140] Cannot get a TGT: ret [1432158230](Network I/O Error)
[sdap_id_op_connect_done] (0x4000): [RID#140] notify error to op #1: 13 [Permission denied]
```

Yet I'm not fully understand:
```
[check_for_combined_2fa_password] (0x1000): [RID#145] Wrong authtok type.
[sysdb_cache_auth] (0x0100): [RID#145] Authentication failed.
[krb5_auth_cache_creds] (0x0020): [RID#145] Offline authentication failed
```
Comment 5 Alexey Tikhonov 2026-05-06 10:33:38 UTC 
(In reply to Alexey Tikhonov from comment #4)
> ```
> [check_for_combined_2fa_password] (0x1000): [RID#145] Wrong authtok type.
> [sysdb_cache_auth] (0x0100): [RID#145] Authentication failed.
> [krb5_auth_cache_creds] (0x0020): [RID#145] Offline authentication failed
> ```

Did you enter correct password during this test?
Comment 6 Dmitry 2026-05-06 10:41:13 UTC 
Sorry, my bad, tried several times, no difference in login process to verify the password.
New logs below:

sssd_domain.log
  *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#249] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#249] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#249] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#249] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#249] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#249] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#249] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#249] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#249] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#249] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#249] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#249] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#249] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#250] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#250] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#250] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#250] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#250] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#250] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#250] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#250] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#250] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#250] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#250] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#250] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#250] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=aduser1.com]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#251] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#251] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#251] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#251] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#251] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#251] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#251] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#251] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#251] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#251] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#251] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#251] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#251] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got request with the following data
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): command: SSS_PAM_PREAUTH
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain: ad.domain.com
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): user: aduser1.com
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): service: plasmalogin
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok type: 0 (No authentication token available)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid: 5224
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): child_pid: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon name: not set
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#252] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#252] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#252] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [child_sig_handler] (0x0100): [RID#252] child [5225] finished successfully.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=aduser1.com]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#253] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#253] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#253] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#253] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#253] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#253] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#253] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#253] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#253] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#253] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#253] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#253] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#253] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got request with the following data
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain: ad.domain.com
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): user: aduser1.com
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): service: plasmalogin
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok type: 1 (Password)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid: 5224
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): child_pid: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon name: not set
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#254] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#254] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#254] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200): [RID#254] Entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] has set [ts_cache] attrs.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [sysdb_cache_auth] (0x0100): [RID#254] Hashes do match!
(2026-05-06 13:36:41): [be[ipa.domain.com]] [child_sig_handler] (0x0100): [RID#254] child [5226] finished successfully.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#255] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#255] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#255] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#255] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#255] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#255] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#255] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#255] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#255] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#255] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#255] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#255] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#255] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=aduser1.com]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#256] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#256] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#256] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#256] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#256] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#256] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#256] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#256] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#256] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#256] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#256] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#256] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#256] sdap_id_op_connect request failed.
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got request with the following data
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain: ad.domain.com
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): user: aduser1.com
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): service: plasmalogin
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: 
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok type: 0 (No authentication token available)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available)
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid: 5224
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): child_pid: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon name: not set
(2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0
(2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_access_obtain_filter_lists] (0x0200): [RID#257] Deny users list is empty.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [sss_parse_name] (0x0200): [RID#257] Domain not provided!
(2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_access_obtain_filter_lists] (0x0200): [RID#257] Deny groups list is empty.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_access_check_send] (0x0200): [RID#257] Simple access check for aduser1.com
(2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_check_get_groups_primary] (0x0200): [RID#257] Could not look up primary group [1346422211]: [2][No such file or directory]
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#258] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#258] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#258] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#258] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#258] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#258] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#258] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#258] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#258] No available servers for service 'IPA'
   *  ... skipping repetitive backtrace ...
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#258] Trying to resolve service 'IPA'
(2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#258] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues.
(2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#258] No available servers for service 'IPA'

sssd_nss/pam.log
(2026-05-06 13:36:41): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#10] CR #41: Data Provider Error: 3, 13, Permission denied
(2026-05-06 13:36:41): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#10] CR #43: Data Provider Error: 3, 13, Permission denied
(2026-05-06 13:36:41): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#10] CR #45: Data Provider Error: 3, 13, Permission denied
Comment 7 Alexey Tikhonov 2026-05-06 10:49:25 UTC 
Thank you for the logs.

> [simple_access_check_send] (0x0200): [RID#257] Simple access check for aduser1.com
> [simple_check_get_groups_primary] (0x0200): [RID#257] Could not look up primary group [1346422211]: [2][No such file or directory]

This looks like the consequence of the same bug as mentioned in comment 2
Comment 8 Alexey Tikhonov 2026-05-06 18:22:35 UTC 
Upstream PR: https://github.com/SSSD/sssd/pull/8675
Comment 9 Pavel Březina 2026-05-07 12:33:29 UTC 
Hi, would you mind to try out scratch build from COPR?

sudo dnf copr enable packit/SSSD-sssd-8675 fedora-44-x86_64
sudo dnf upgrade sssd\*
Comment 10 Dmitry 2026-05-07 13:05:00 UTC 
Looks ok - offline mode is operational, no more 'Permission denied' errors.
Comment 11 Alexey Tikhonov 2026-05-13 08:06:10 UTC 
(In reply to Alexey Tikhonov from comment #8)
> Upstream PR: https://github.com/SSSD/sssd/pull/8675

https://github.com/SSSD/sssd/commit/c5b631ee6df531b506d2b2ba7f2d9f0b9de02746

sssd-2-13: https://github.com/SSSD/sssd/pull/8701
Comment 12 Alexey Tikhonov 2026-05-13 11:25:20 UTC 
(In reply to Alexey Tikhonov from comment #11)
> 
> sssd-2-13: https://github.com/SSSD/sssd/pull/8701

https://github.com/SSSD/sssd/commit/c3acaa3a5104ee32efdb536b311a343276afb5d0
Comment 13 Alexey Tikhonov 2026-05-26 07:55:54 UTC 
*** Bug 2481235 has been marked as a duplicate of this bug. ***
Comment 14 Fedora Update System 2026-06-10 10:05:35 UTC 
FEDORA-2026-851bc3ae6a (sssd-2.13.1-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-851bc3ae6a
Comment 15 Fedora Update System 2026-06-11 01:48:59 UTC 
FEDORA-2026-851bc3ae6a has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-851bc3ae6a`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-851bc3ae6a

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 16 Fedora Update System 2026-06-12 00:59:46 UTC 
FEDORA-2026-851bc3ae6a (sssd-2.13.1-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.