Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1134940 - sssd does not recognize Windows server 2012 R2's LDAP as AD
sssd does not recognize Windows server 2012 R2's LDAP as AD
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd (Show other bugs)
7.0
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Jakub Hrozek
Kaushik Banerjee
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2014-08-28 09:26 EDT by Martin Kosek
Modified: 2015-03-05 05:33 EST (History)
6 users (show)

See Also:
Fixed In Version: sssd-1.12.1-1.el7
Doc Type: Bug Fix
Doc Text:
Cause: The SSSD contains a hardcoded list of supported AD servers. This list was missing the Windows Server 2012R2 release. Consequence: Clients connected to WS2012R2 printed a scary debug message to the logs and were unable to use several AD-specific performance enhancements. Fix: WS2012R2 was added to the list of supported Windows servers. Result: Clients connected to WS2012R2 now run faster due to using several AD-specific performance enhancements and no longer print a warning to the logs.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-03-05 05:33:24 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:0441 normal SHIPPED_LIVE sssd bug fix and enhancement update 2015-03-05 10:05:27 EST

  None (edit)
Description Martin Kosek 2014-08-28 09:26:19 EDT
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/2418

sssd code includes hard coded values for AD DC os version:

https://git.fedorahosted.org/cgit/sssd.git/tree/src/providers/ldap/sdap.c

{{{
if (ret == EOK) {
	/* Validate that the DC level matches an expected value */
	switch(dc_level) {
	case DS_BEHAVIOR_WIN2000:
	case DS_BEHAVIOR_WIN2003:
	case DS_BEHAVIOR_WIN2008:
	case DS_BEHAVIOR_WIN2008R2:
	case DS_BEHAVIOR_WIN2012:
		opts->dc_functional_level = dc_level;
		DEBUG(SSSDBG_CONF_SETTINGS,
			  "Setting AD compatibility level to [%d]\n",
			   opts->dc_functional_level);
		break;
	default:
		DEBUG(SSSDBG_MINOR_FAILURE,
			  "Received invalid value for AD compatibility level. "
			   "Continuing without AD performance enhancements\n");
	}
} else if (ret != ENOENT) {
	DEBUG(SSSDBG_MINOR_FAILURE,
		  "Error detecting Active Directory compatibility level "
		   "(%s). Continuing without AD performance enhancements\n",
		   strerror(ret));
}
}}}

https://git.fedorahosted.org/cgit/sssd.git/tree/src/providers/ldap/sdap.h

{{{
/* Values from
 * http://msdn.microsoft.com/en-us/library/cc223272%28v=prot.13%29.aspx
 */
enum dc_functional_level {
    DS_BEHAVIOR_WIN2000 = 0,
    DS_BEHAVIOR_WIN2003 = 2,
    DS_BEHAVIOR_WIN2008 = 3,
    DS_BEHAVIOR_WIN2008R2 = 4,
    DS_BEHAVIOR_WIN2012 = 5
};
}}}

There is a new OS version avalable in:
http://msdn.microsoft.com/en-us/library/cc223272%28v=prot.13%29.aspx
6 = DS_BEHAVIOR_WIN2012R2

This means sssd cant does not treat MS AD 2012R2 LDAP as AD with all the optimizations.
Comment 1 Jakub Hrozek 2014-09-01 07:53:34 EDT
    master
        5c2f2023696d1ff79c3c5d94b89e7ef9cd4159e9
        0fafb51756913e78dbf523a69fc3a4ef2bac54ec
        9ea0969f6a9e52b7c57feb5808266b0739ee40a4 
    sssd-1-11:
        7f59cc485c935bd3bca9900b03eb24e755f9bdfd
        aaab5cd6c1ff71b520a4943e4c7d6d7ed236bc46
        de4788be9b6ce457e132bf124c01ab674279703a
Comment 3 Kaushik Banerjee 2014-12-29 06:34:33 EST
With sssd-1.11.6-30.el6_6.3 , domain log shows:

(Mon Dec 29 06:22:46 2014) [sssd[be[sssdad2012r2.com]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements


With sssd-1.12.2-39.el7 , domain log shows:

(Mon Dec 29 16:59:03 2014) [sssd[be[sssdad2012r2.com]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [6]
Comment 5 errata-xmlrpc 2015-03-05 05:33:24 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0441.html

Note You need to log in before you can comment on or make changes to this bug.