| Summary: | Unable to bind to IPA server when minssf set | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Erinn Looney-Triggs <erinn.looneytriggs> | |
| Component: | sssd | Assignee: | Stephen Gallagher <sgallagh> | |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 16 | CC: | jhrozek, sbose, sgallagh, ssorce | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | sssd-1.8.3-11.fc16 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 803842 (view as bug list) | Environment: | ||
| Last Closed: | 2012-05-15 23:25:49 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Bug Depends On: | ||||
| Bug Blocks: | 803842 | |||
|
Description
Erinn Looney-Triggs
2012-03-14 17:38:55 UTC
Upstream ticket: https://fedorahosted.org/sssd/ticket/1257 Ok, it turns out that there are two bugs at play here. The first is a 389-DS bug: https://fedorahosted.org/389/ticket/168 Basically, when setting the minssf to 56, it prevents SSSD from being able to read the RootDSE (that contains some basic information about the LDAP server's capabilities). In SSSD 1.5.x (aka RHEL 5.8 and 6.2) we had a bug that was coincidentally working in your favor. We weren't throwing an error at one particular point, and instead we continued on. Just by pure luck, this would work fine with SSSD as long as enumerate = false (it could result in some unfortunate behavior with enumerate=true). In SSSD 1.8.x, we fixed the error so that now the RootDSE is failing loudly instead of silently. In the average (non-IPA) case, we should be allowing it to just continue on, and we're submitting a patch upstream to do that. This will result in you continuing to see the behavior you saw on 1.5.x. But the correct long-term fix is for https://fedorahosted.org/389/ticket/168 to be fixed (and for you to set the nsslapd-minssf-exclude-rootdse option. Correcting the previous statement. We cannot count on the server to always behave properly (this issue has turned up on AD and OpenLDAP configurations as well). We need to modify SSSD so that if it cannot get the RootDSE prior to authentication, we should attempt to acquire it afterwards. https://fedorahosted.org/sssd/ticket/1258 sssd-1.8.3-11.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/sssd-1.8.3-11.fc17 sssd-1.8.3-11.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/sssd-1.8.3-11.fc16 Package sssd-1.8.3-11.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing sssd-1.8.3-11.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-7279/sssd-1.8.3-11.fc17 then log in and leave karma (feedback). sssd-1.8.3-11.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. sssd-1.8.3-11.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. |