Bug 1029457 - "getent passwd username" do not work if enumeration is not enabled with AD backend
"getent passwd username" do not work if enumeration is not enabled with AD ba...
Status: CLOSED WORKSFORME
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd (Show other bugs)
7.0
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Jakub Hrozek
Kaushik Banerjee
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-11-12 07:31 EST by Nirupama Karandikar
Modified: 2016-05-05 00:36 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-11-14 04:33:44 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Nirupama Karandikar 2013-11-12 07:31:07 EST
Description of problem:
On sssd-1.11.1-2.el7.x86_64 with ad backend. The "getent passwd sssduser1" do not work if "enumerate = false" is set in sssd.conf. 

Version-Release number of selected component (if applicable):
sssd-1.11.1-2.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Set "enumerate = false" in sssd.conf 
2. Use ad backend against Active Directory
3. Run getent passwd sssduser1, this will give blank output.

Actual results:
The "getent passwd sssduser1" gives blank output.

Expected results:
The "getent passwd sssduser1" should work without any issue.

Additional info:

# getent passwd sssduser1

From domain logs - /var/log/sssd/sssd_ADTEST.log
------------------------------------------
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [be_get_account_info] (0x0100): Got request for [4097][1][name=sssduser1]
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_step] (0x4000): beginning to connect
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD_GC'
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD_GC'
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [be_mark_offline] (0x2000): Going offline!
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #1
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [ad_account_info_complete] (0x0010): Bug: dp_error is OK on failed request(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,11,Internal Error (Have exhausted maximum number of retries for service)
(Tue Nov 12 17:29:12 2013) [sssd[be[ADTEST]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection
-------------------------------------------

# getent group group1
From domain logs - /var/log/sssd/sssd_ADTEST.log
------------------------------------------
(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [be_get_account_info] (0x0100): Got request for [4098][1][name=group1]
(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_step] (0x4000): beginning to connect
(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD_GC'
(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD_GC'
(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5
(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])
(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [be_mark_offline] (0x2000): Going offline!
(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #1
(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [ad_account_info_complete] (0x0010): Bug: dp_error is OK on failed request(Tue Nov 12 17:27:47 2013) [sssd[be[ADTEST]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,11,Internal Error (Have exhausted maximum number of retries for service)
-------------------------------------------

If set "enumerate = true" getent works without any issue.
Comment 1 Jakub Hrozek 2013-11-12 07:34:49 EST
Do fully qualified names work? getent passwd username@ADTEST in your case.
Comment 2 Nirupama Karandikar 2013-11-12 08:02:17 EST
Hi Jakub,

I tried "getent passwd sssduser1@ADTEST", still it do not work. The domain logs gives same error as previous.

----------------------------------
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [be_get_account_info] (0x0100): Got request for [4097][1][name=sssduser1]
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_step] (0x4000): beginning to connect
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD_GC'
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD_GC'
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [be_mark_offline] (0x2000): Going offline!
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #1
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [ad_account_info_complete] (0x0010): Bug: dp_error is OK on failed request(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,11,Internal Error (Have exhausted maximum number of retries for service)
(Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection
----------------------------------

Thanks,

Niru
Comment 4 Lukas Slebodnik 2013-11-12 08:10:27 EST
(In reply to Nirupama Karandikar from comment #2)
> Hi Jakub,
> 
> I tried "getent passwd sssduser1@ADTEST", still it do not work. The domain
> logs gives same error as previous.
> 
> ----------------------------------
> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [be_get_account_info]
> (0x0100): Got request for [4097][1][name=sssduser1]
> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_step]
> (0x4000): beginning to connect
> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [fo_resolve_service_send]
> (0x0100): Trying to resolve service 'AD_GC'
> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [fo_resolve_service_send]
> (0x0020): No available servers for service 'AD_GC'
> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [be_resolve_server_done]
> (0x1000): Server resolution failed: 5
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^
It look like disabled global catalog on you AD.

> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_done]
> (0x0020): Failed to connect, going offline (5 [Input/output error])
> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [be_mark_offline] (0x2000):
> Going offline!
> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [be_run_offline_cb] (0x0080):
> Going offline. Running callbacks.
> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_done]
> (0x4000): notify offline to op #1
> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [ad_account_info_complete]
> (0x0010): Bug: dp_error is OK on failed request(Tue Nov 12 18:29:05 2013)
> [sssd[be[ADTEST]]] [acctinfo_callback] (0x0100): Request processed. Returned
> 3,11,Internal Error (Have exhausted maximum number of retries for service)
> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [sdap_id_release_conn_data]
> (0x4000): releasing unused connection

This bug was fixed in the sssd 1.11.2.
Comment 5 Nirupama Karandikar 2013-11-13 00:33:48 EST
Hi Jakub,

Under NTDS settings on my AD DC, I can see Global Catalog is working on it. Also I am able to telnet to port 3268.


# telnet 10.65.207.124 3268
Trying 10.65.207.124...
Connected to 10.65.207.124.
Escape character is '^]'.

Am I missing anything ?

If I understood correctly, the following error is coming due to AD GC is not reachable. However when enable enumerate it able to pull users/groups at start of the service.

> (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_done]
> (0x0020): Failed to connect, going offline (5 [Input/output error])

Is "enumerate" doing anything special here ?

Thanks,

Niru
Comment 6 Lukas Slebodnik 2013-11-13 01:53:02 EST
AD Enumeration reads data from LDAP while regular lookups connect to GC.
It's known bug, but it has not been fixed in upstream yet.
https://fedorahosted.org/sssd/ticket/2142
Comment 7 Jakub Hrozek 2013-11-13 03:50:31 EST
(In reply to Nirupama Karandikar from comment #5)
> Hi Jakub,
> 
> Under NTDS settings on my AD DC, I can see Global Catalog is working on it.
> Also I am able to telnet to port 3268.
> 
> 
> # telnet 10.65.207.124 3268
> Trying 10.65.207.124...
> Connected to 10.65.207.124.
> Escape character is '^]'.
> 
> Am I missing anything ?
> 
> If I understood correctly, the following error is coming due to AD GC is not
> reachable. However when enable enumerate it able to pull users/groups at
> start of the service.
> 
> > (Tue Nov 12 18:29:05 2013) [sssd[be[ADTEST]]] [sdap_id_op_connect_done]
> > (0x0020): Failed to connect, going offline (5 [Input/output error])
> 
> Is "enumerate" doing anything special here ?
> 
> Thanks,
> 
> Niru

Can you paste or attach larger portion of the logs or give us access to the linux client you are debugging?
Comment 8 Nirupama Karandikar 2013-11-14 03:28:54 EST
Hi Jakub,

It seems that there was some temporary issue AD Global Catalogue. It working for me now.

I also tried on newly build RHEL7 and it works for me now.

Niru
Comment 9 Jakub Hrozek 2013-11-14 04:33:44 EST
(In reply to Nirupama Karandikar from comment #8)
> Hi Jakub,
> 
> It seems that there was some temporary issue AD Global Catalogue. It working
> for me now.
> 
> I also tried on newly build RHEL7 and it works for me now.
> 
> Niru

Great, I'll close the bug for now but please reopen if it hits again.

Note You need to log in before you can comment on or make changes to this bug.