Bug 803842

Summary:	Unable to bind to LDAP server when minssf set
Product:	Red Hat Enterprise Linux 6	Reporter:	Stephen Gallagher <sgallagh>
Component:	sssd	Assignee:	Stephen Gallagher <sgallagh>
Status:	CLOSED ERRATA	QA Contact:	IDM QE LIST <seceng-idm-qe-list>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.3	CC:	erinn.looneytriggs, grajaiya, jgalipea, jhrozek, kbanerje, prc, sbose, sgallagh, ssorce
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	sssd-1.8.0-17.el6	Doc Type:	Bug Fix
Doc Text:	No technical note required	Story Points:	---
Clone Of:	803436	Environment:
Last Closed:	2012-06-20 11:56:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	803436
Bug Blocks:

Description Stephen Gallagher 2012-03-15 18:25:47 UTC

+++ This bug was initially created as a clone of Bug #803436 +++

Description of problem:
I changed the configuration of my IPA server and set minssf to 56, as is documented n the IPA guide. All my RHEL based systems continue to function. But my one fedora desktop is now unable to bind to the server, and as such is not getting any updated information. 

From the logs:
Unexpected result from ldap: Server is unwilling to perform(53), Minimum SSF not met.


Version-Release number of selected component (if applicable):
sssd-1.8.0-6.fc16.x86_64

How reproducible:
set minssf on server, watch sssd fail to bind. Frankly with all the caching that goes on I wouldn't have even noticed that it wasn't working except for a password change that arose after minssf was set. 

As I said this continues to work fine in RHEL 5 and 6, so chances are this is something new or a bugfix that wasn't forward ported.

-Erinn

--- Additional comment from sgallagh on 2012-03-15 13:47:41 EDT ---

Upstream ticket:
https://fedorahosted.org/sssd/ticket/1257

--- Additional comment from sgallagh on 2012-03-15 14:03:24 EDT ---

Ok, it turns out that there are two bugs at play here.

The first is a 389-DS bug: https://fedorahosted.org/389/ticket/168
Basically, when setting the minssf to 56, it prevents SSSD from being able to read the RootDSE (that contains some basic information about the LDAP server's capabilities). In SSSD 1.5.x (aka RHEL 5.8 and 6.2) we had a bug that was coincidentally working in your favor. We weren't throwing an error at one particular point, and instead we continued on.

Just by pure luck, this would work fine with SSSD as long as enumerate = false (it could result in some unfortunate behavior with enumerate=true).

In SSSD 1.8.x, we fixed the error so that now the RootDSE is failing loudly instead of silently. In the average (non-IPA) case, we should be allowing it to just continue on, and we're submitting a patch upstream to do that. This will result in you continuing to see the behavior you saw on 1.5.x.

But the correct long-term fix is for https://fedorahosted.org/389/ticket/168 to be fixed (and for you to set the nsslapd-minssf-exclude-rootdse option.

Comment 1 Stephen Gallagher 2012-03-15 18:28:13 UTC

Updating summary. This is not exclusive to IPA.

Comment 3 Erinn Looney-Triggs 2012-03-21 19:27:14 UTC

Thanks for the detailed info, any idea when 389 will be updated in RHEL 6 so that I can set the nsslapd-minssf-exclude-rootdse option?

-Erinn

Comment 4 Stephen Gallagher 2012-03-22 12:20:35 UTC

(In reply to comment #3)
> Thanks for the detailed info, any idea when 389 will be updated in RHEL 6 so
> that I can set the nsslapd-minssf-exclude-rootdse option?
> 
> -Erinn

I don't personally know. I'd strongly suggest speaking to your support representative and opening a case with them. That will go a long way towards setting the proper priority for the 389 team.

Comment 5 Stephen Gallagher 2012-04-10 16:51:01 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
No technical note required

Comment 7 Kaushik Banerjee 2012-04-26 06:55:09 UTC

Verified in version:

# rpm -qi sssd | head
Name        : sssd                         Relocations: (not relocatable)
Version     : 1.8.0                             Vendor: Red Hat, Inc.
Release     : 23.el6                        Build Date: Fri 20 Apr 2012 11:30:39 PM IST
Install Date: Wed 25 Apr 2012 07:28:48 PM IST      Build Host: x86-003.build.bos.redhat.com
Group       : Applications/System           Source RPM: sssd-1.8.0-23.el6.src.rpm
Size        : 7874744                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://fedorahosted.org/sssd/
Summary     : System Security Services Daemon

Comment 9 errata-xmlrpc 2012-06-20 11:56:02 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0747.html