Hide Forgot
Description of problem: When SSSD goes offline due to a network connectivity issue, the first login atempt fails and does not allow the user to login or su. Following attempts do work. Upstream ticket: https://fedorahosted.org/sssd/ticket/2964 Version-Release number of selected component (if applicable): 1.13.3 How reproducible: Always. Steps to Reproduce: 1. Setup SSSD and permit user to access host via GPO access. 2. Force SSSD to go offline using iptables and block the port. iptables -F iptables -A INPUT -s $AD_SERVER1_IP -j DROP iptables -A OUTPUT -d $AD_SERVER1_IP -j DROP 3. Attempt to login or su ** Or run downstrean QE tests ** Actual results: User is not allowed to login. Expected results: User can login. Additional info:
Upstream ticket: https://fedorahosted.org/sssd/ticket/2964
master: * bdd533146cb2da71b7c39ad0efa2e5baca7257eb sssd-1-13: * 33973418462b75592122343e318045a6905c475b
Verified against sssd-client.x86_64 0:1.13.3-53.el6 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: ad_gpo_007: ad gpo offline mode :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: File '/var/log/sssd/sssd_sssdad.com.log' should contain 'offline' :: [ BEGIN ] :: Running 'su_success 'allow_u-1666474' Secret123' spawn su --shell /bin/sh nobody -- -c su --shell /bin/true -- "$1" -- allow_u-1666474 Password: :: [ PASS ] :: Command 'su_success 'allow_u-1666474' Secret123' (Expected 0, got 0) :: [ BEGIN ] :: Running 'su_success 'allow_gu-1666474' Secret123' spawn su --shell /bin/sh nobody -- -c su --shell /bin/true -- "$1" -- allow_gu-1666474 Password: :: [ PASS ] :: Command 'su_success 'allow_gu-1666474' Secret123' (Expected 0, got 0) :: [ BEGIN ] :: Running 'su_fail 'regular_u-1666474' Secret123' spawn su --shell /bin/sh nobody -- -c su --shell /bin/true -- "$1" -- regular_u-1666474 Password:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2017-0632.html