Description of problem: sssd denies access to users trying to log into the machine, due to "System Error" Version-Release number of selected component (if applicable): sssd-1.12.0-7.fc21.x86_64 How reproducible: Every time Steps to Reproduce: 1. realm join my-domain.com 2. ssh with known good user from another machine 3. look at journal Actual results: Sep 23 17:42:35 jalisco.borg.lan sshd[1264]: fatal: Access denied for user fry by PAM account configuration [preauth] Expected results: Logged in Additional info: [stef@jalisco ~]$ sudo cat /etc/sssd/sssd.conf [sssd] domains = borg.lan config_file_version = 2 services = nss, pam [domain/borg.lan] ad_domain = borg.lan krb5_realm = BORG.LAN realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = ad
Work around is to use access_provider = simple
No additional logs are available in /var/log/sssd :( [root@jalisco sssd]# ls -l /var/log/sssd total 0 -rw-------. 1 root root 0 Sep 23 17:41 gpo_child.log -rw-------. 1 root root 0 Sep 23 17:38 krb5_child.log -rw-------. 1 root root 0 Sep 23 17:38 ldap_child.log -rw-------. 1 root root 0 Sep 23 17:38 sssd_borg.lan.log -rw-------. 1 root root 0 Sep 23 17:38 sssd.log -rw-------. 1 root root 0 Sep 23 17:38 sssd_nss.log -rw-------. 1 root root 0 Sep 23 17:38 sssd_pam.log It seems sssd should log more about a 'System Error' somewhere by default.
Can you raise debug_level=10 in the domain section and generate the logs again? Chances are the logs we need are sssd_borg.lan.log and krb5_child.log.
Another workaround might be: ad_gpo_access_control = disabled The GPO code is the only part in sssd that changed recently related to access control.
Stef, do you have any access-control GPOs set up on Windows, or is it relying entirely on the built-in domain defaults?
Entirely
sssd-1.12.1-2.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/FEDORA-2014-10547/sssd-1.12.1-2.fc21
Entirely fixed with sssd-1.12.1
sssd-1.12.1-2.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.