Fedora Account System
Red Hat Associate
Red Hat Customer
After upgrading Fedora 43 to 44 windows domain accounts linked via freeipa stopped working in offline mode. Also confirmed that installing fc43 packages of sssd (v.2.12) to fc44 restores normal work. And upgrading them back to fc44 (v.2.13) restores the problem. Logs are full of: (2026-05-06 11:54:57): [ssh] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#7] CR #6: Data Provider Error: 3, 13, Permission denied (2026-05-06 11:54:57): [ssh] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#8] CR #7: Data Provider Error: 3, 13, Permission denied (2026-05-06 11:54:57): [nss] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#16] CR #140: Data Provider Error: 3, 13, Permission denied (2026-05-06 11:55:00): [nss] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#16] CR #141: Data Provider Error: 3, 13, Permission denied (2026-05-06 11:54:38): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#3] CR #7: Data Provider Error: 3, 13, Permission denied (2026-05-06 11:54:57): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#4] CR #11: Data Provider Error: 3, 13, Permission denied (2026-05-06 11:54:06): [sudo] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#1] CR #0: Data Provider Error: 3, 13, Permission denied (2026-05-06 11:54:06): [sudo] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#1] CR #1: Data Provider Error: 3, 13, Permission denied [ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied) [ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied [ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied Disabling selinux doesn't change anything. If access_provider=permit - same result and errors. If sssd goes online - everything works ok, no errors. Cleaning cache - no effect. I compared file/forder permissions (/etc/sssd, /var/lib/sss) on fc43 (v2.12) and fc44 (v.2.13) - didn't find any difference. Checked also on a fresh fc44 installation - same result, if 2.13 - permission denied errors Reproducible: Always
Hi, (In reply to Dmitry from comment #0) > [ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied) > [ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied > [ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied Could you please clear /var/log/sssd/*, reproduce an issue and attach sanitized /var/log/sssd/sssd_$domain.log?
> > [ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied) > > [ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied > > [ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied Probably it's https://github.com/SSSD/sssd/blob/master/src/providers/ldap/sdap_async_connection.c#L2208 and change introduced by https://github.com/SSSD/sssd/commit/cc42932ac4c58c681d4d928b53f2803bbb9ad277
debug_level = 5 sssd_domain.log: (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com] (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0100): [RID#140] Resetting the status of port 0 for server '(no name)' (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_send] (0x0200): [RID#140] The status of SRV lookup is neutral (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_getsrv_send] (0x0100): [RID#140] Trying to resolve SRV record of '_ldap._tcp.ipa.domain.com' (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_discover_srv_done] (0x0040): [RID#140] SRV query failed [4]: Domain name not found ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-06 12:57:37): [be[ipa.domain.com]] [check_wait_queue] (0x1000): [RID#139] Wait queue for user [aduser1.com] is empty. * (2026-05-06 12:57:37): [be[ipa.domain.com]] [krb5_auth_queue_done] (0x1000): [RID#139] krb5_auth_queue request [0x55b6e5652ec0] done. * (2026-05-06 12:57:37): [be[ipa.domain.com]] [dp_req_done] (0x0400): [RID#139] DP Request [PAM Authenticate #139]: Request handler finished [0]: Success * (2026-05-06 12:57:37): [be[ipa.domain.com]] [_dp_req_recv] (0x0400): [RID#139] DP Request [PAM Authenticate #139]: Receiving request data. * (2026-05-06 12:57:37): [be[ipa.domain.com]] [dp_req_destructor] (0x0400): [RID#139] DP Request [PAM Authenticate #139]: Request removed. * (2026-05-06 12:57:37): [be[ipa.domain.com]] [dp_req_destructor] (0x0400): [RID#139] Number of active DP request: 0 * (2026-05-06 12:57:37): [be[ipa.domain.com]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.pamHandler on /sssd from sssd.pam: Success * (2026-05-06 12:57:37): [be[ipa.domain.com]] [child_sig_handler] (0x1000): [RID#139] Waiting for child [4953]. * (2026-05-06 12:57:37): [be[ipa.domain.com]] [child_sig_handler] (0x0100): [RID#139] child [4953] finished successfully. * (2026-05-06 12:58:37): [be[ipa.domain.com]] [be_subdom_reset_status] (0x1000): [RID#137] Resetting subdomain ad.domain.com * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sbus_dispatch] (0x4000): Dispatching. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd from sssd.nss * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.nss] * (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com] * (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_attach_req] (0x0400): [RID#140] DP Request [Account #140]: REQ_TRACE: New request. [sssd.nss CID #20] Flags [0x0001]. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_attach_req] (0x0400): [RID#140] Number of active DP request: 1 * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_id_op_connect_step] (0x4000): [RID#140] beginning to connect * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_kinit_send] (0x0400): [RID#140] Attempting kinit (default, host/aduser1.vm.ipa.domain.com, ipa.domain.com, 86400) * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_kinit_next_kdc] (0x1000): [RID#140] Resolving next KDC for service IPA * (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x1000): [RID#140] Port status of port 0 for server '(no name)' is 'not working' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0100): [RID#140] Resetting the status of port 0 for server '(no name)' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_activate_timeout] (0x2000): [RID#140] Resolve timeout [dns_resolver_timeout] set to 6 seconds * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_srv_data_status] (0x0400): [RID#140] Changing state of SRV lookup from 'SRV_RESOLVE_ERROR' to 'SRV_NEUTRAL'. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_send] (0x0200): [RID#140] The status of SRV lookup is neutral * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_discover_srv_next_domain] (0x0400): [RID#140] SRV resolution of service 'ldap'. Will use DNS discovery domain 'ipa.domain.com' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_getsrv_send] (0x0100): [RID#140] Trying to resolve SRV record of '_ldap._tcp.ipa.domain.com' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_request_timeout] (0x2000): [RID#140] Scheduling a timeout of 3 seconds * (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_timeout_watcher] (0x2000): [RID#140] Scheduling DNS timeout watcher * (2026-05-06 12:59:01): [be[ipa.domain.com]] [unschedule_timeout_watcher] (0x4000): [RID#140] Unscheduling DNS timeout watcher * (2026-05-06 12:59:01): [be[ipa.domain.com]] [request_watch_destructor] (0x0400): [RID#140] Deleting request watch * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_discover_srv_done] (0x0040): [RID#140] SRV query failed [4]: Domain name not found ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_set_port_status] (0x0100): [RID#140] Marking port 0 of server '(no name)' as 'not working' (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_done] (0x0040): [RID#140] Unable to resolve SRV [1432158237]: SRV record not found ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_set_port_status] (0x0100): [RID#140] Marking port 0 of server '(no name)' as 'not working' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolve_srv_done] (0x0040): [RID#140] Unable to resolve SRV [1432158237]: SRV record not found ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_srv_data_status] (0x0100): [RID#140] Marking SRV lookup of service 'IPA' as 'not resolved' (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x0080): [RID#140] Couldn't resolve server (SRV lookup meta-server), resolver returned [1432158237]: SRV record not found (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x0100): [RID#140] Resetting the server status of 'node4.ipa.domain.com' (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#140] Trying to resolve A record of 'node4.ipa.domain.com' in files (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status] (0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'resolving name' (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#140] Trying to resolve AAAA record of 'node4.ipa.domain.com' in files (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0200): [RID#140] No more address families to retry (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_dns_query] (0x0100): [RID#140] Trying to resolve A record of 'node4.ipa.domain.com' in DNS (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_dns_query] (0x0100): [RID#140] Trying to resolve AAAA record of 'node4.ipa.domain.com' in DNS (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0200): [RID#140] No more address families to retry (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0100): [RID#140] No more hosts databases to retry (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_done] (0x0020): [RID#140] Failed to resolve server 'node4.ipa.domain.com': Domain name not found ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_srv_data_status] (0x0100): [RID#140] Marking SRV lookup of service 'IPA' as 'not resolved' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x0080): [RID#140] Couldn't resolve server (SRV lookup meta-server), resolver returned [1432158237]: SRV record not found * (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x1000): [RID#140] Trying with the next one! * (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000): [RID#140] Status of server 'node4.ipa.domain.com' is 'not working' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x0100): [RID#140] Resetting the server status of 'node4.ipa.domain.com' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x1000): [RID#140] Port status of port 0 for server 'node4.ipa.domain.com' is 'neutral' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_activate_timeout] (0x2000): [RID#140] Resolve timeout [dns_resolver_timeout] set to 6 seconds * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000): [RID#140] Status of server 'node4.ipa.domain.com' is 'name not resolved' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_is_unix] (0x4000): [RID#140] [node4.ipa.domain.com] does not look like a unix domain socket * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_is_address] (0x4000): [RID#140] [node4.ipa.domain.com] does not look like an IP address * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step] (0x2000): [RID#140] Querying files * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#140] Trying to resolve A record of 'node4.ipa.domain.com' in files * (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status] (0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'resolving name' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step] (0x2000): [RID#140] Querying files * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#140] Trying to resolve AAAA record of 'node4.ipa.domain.com' in files * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0200): [RID#140] No more address families to retry * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step] (0x2000): [RID#140] Querying DNS * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_dns_query] (0x0100): [RID#140] Trying to resolve A record of 'node4.ipa.domain.com' in DNS * (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_request_timeout] (0x2000): [RID#140] Scheduling a timeout of 3 seconds * (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_timeout_watcher] (0x2000): [RID#140] Scheduling DNS timeout watcher * (2026-05-06 12:59:01): [be[ipa.domain.com]] [unschedule_timeout_watcher] (0x4000): [RID#140] Unscheduling DNS timeout watcher * (2026-05-06 12:59:01): [be[ipa.domain.com]] [request_watch_destructor] (0x0400): [RID#140] Deleting request watch * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_step] (0x2000): [RID#140] Querying DNS * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_dns_query] (0x0100): [RID#140] Trying to resolve AAAA record of 'node4.ipa.domain.com' in DNS * (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_request_timeout] (0x2000): [RID#140] Scheduling a timeout of 3 seconds * (2026-05-06 12:59:01): [be[ipa.domain.com]] [schedule_timeout_watcher] (0x2000): [RID#140] Scheduling DNS timeout watcher * (2026-05-06 12:59:01): [be[ipa.domain.com]] [unschedule_timeout_watcher] (0x4000): [RID#140] Unscheduling DNS timeout watcher * (2026-05-06 12:59:01): [be[ipa.domain.com]] [request_watch_destructor] (0x0400): [RID#140] Deleting request watch * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0200): [RID#140] No more address families to retry * (2026-05-06 12:59:01): [be[ipa.domain.com]] [resolv_gethostbyname_next] (0x0100): [RID#140] No more hosts databases to retry * (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_done] (0x0020): [RID#140] Failed to resolve server 'node4.ipa.domain.com': Domain name not found ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status] (0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'not working' (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x0080): [RID#140] Couldn't resolve server (node4.ipa.domain.com), resolver returned [11]: Resource temporarily unavailable (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#140] No available servers for service 'IPA' ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-06 12:59:01): [be[ipa.domain.com]] [set_server_common_status] (0x0100): [RID#140] Marking server 'node4.ipa.domain.com' as 'not working' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x0080): [RID#140] Couldn't resolve server (node4.ipa.domain.com), resolver returned [11]: Resource temporarily unavailable * (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_process] (0x1000): [RID#140] Trying with the next one! * (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000): [RID#140] Status of server 'node4.ipa.domain.com' is 'not working' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x1000): [RID#140] Port status of port 0 for server '(no name)' is 'not working' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_server_status] (0x1000): [RID#140] Status of server 'node4.ipa.domain.com' is 'not working' * (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#140] No available servers for service 'IPA' ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#140] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#140] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#140] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#140] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#140] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#140] sdap_id_op_connect request failed. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_id_release_conn_data] (0x4000): [RID#140] Releasing unused connection with fd [-1] * (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_done] (0x1000): [RID#140] Server [NULL] resolution failed: [5]: Input/output error * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_cli_resolve_and_connect_kinit_done] (0x0400): [RID#140] Cannot get a TGT: ret [1432158230](Network I/O Error) * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sdap_id_op_connect_done] (0x4000): [RID#140] notify error to op #1: 13 [Permission denied] * (2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#140] sdap_id_op_connect request failed. ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com] (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#141] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#141] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#141] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#141] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#141] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#141] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#141] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#141] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#141] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#141] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#141] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#141] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#141] sdap_id_op_connect request failed. * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=aduser1.com] (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#142] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#142] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#142] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#142] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#142] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#142] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#142] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#142] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#142] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#142] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#142] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#142] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#142] sdap_id_op_connect request failed. * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got request with the following data (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): command: SSS_PAM_PREAUTH (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain: ad.domain.com (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): user: aduser1.com (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): service: plasmalogin (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok type: 0 (No authentication token available) (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available) (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1 (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid: 4975 (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): child_pid: 0 (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon name: not set (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0 (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#143] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#143] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#143] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [child_sig_handler] (0x0100): [RID#143] child [4976] finished successfully. (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=aduser1.com] (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#144] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#144] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#144] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#144] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#144] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#144] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#144] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#144] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#144] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#144] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#144] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#144] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#144] sdap_id_op_connect request failed. * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got request with the following data (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain: ad.domain.com (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): user: aduser1.com (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): service: plasmalogin (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok type: 1 (Password) (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available) (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1 (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid: 4975 (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): child_pid: 0 (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon name: not set (2026-05-06 12:59:01): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0 (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#145] Trying to resolve service 'IPA' (2026-05-06 12:59:01): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#145] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 12:59:01): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#145] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200): [RID#145] Entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] has set [ts_cache] attrs. (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_cache_auth] (0x0100): [RID#145] Authentication failed. (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200): [RID#145] Entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] has set [cache, ts_cache] attrs. (2026-05-06 12:59:01): [be[ipa.domain.com]] [krb5_auth_cache_creds] (0x0020): [RID#145] Offline authentication failed ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_resolve_server_done] (0x1000): [RID#145] Server [NULL] resolution failed: [5]: Input/output error * (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_mark_dom_offline] (0x1000): [RID#145] Marking subdomain ad.domain.com offline * (2026-05-06 12:59:01): [be[ipa.domain.com]] [be_mark_subdom_offline] (0x4000): [RID#145] Subdomain already inactive * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sss_child_handler_setup] (0x2000): [RID#145] Setting up signal handler up for pid [4977] * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sss_child_handler_setup] (0x2000): [RID#145] Signal handler set up for pid [4977] * (2026-05-06 12:59:01): [be[ipa.domain.com]] [_write_pipe_handler] (0x0400): [RID#145] All data has been sent! * (2026-05-06 12:59:01): [be[ipa.domain.com]] [_read_pipe_handler] (0x4000): [RID#145] Adding [53] bytes of data. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [_read_pipe_handler] (0x0400): [RID#145] All data received * (2026-05-06 12:59:01): [be[ipa.domain.com]] [parse_krb5_child_response] (0x1000): [RID#145] child response: status code: 0 (Success), msg type: 3 (Env variable to be set with pam_putenv(3)), len: 41 * (2026-05-06 12:59:01): [be[ipa.domain.com]] [krb5_mod_ccname] (0x4000): [RID#145] Save ccname [KEYRING:persistent:1346422211] for user [aduser1.com]. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200): [RID#145] Entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] has set [ts_cache] attrs. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [merge_msg_ts_attrs] (0x2000): [RID#145] No such DN in the timestamp cache: name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#145] TS cache doesn't contain this DN, skipping * (2026-05-06 12:59:01): [be[ipa.domain.com]] [merge_msg_ts_attrs] (0x2000): [RID#145] No such DN in the timestamp cache: name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_merge_res_ts_attrs] (0x2000): [RID#145] TS cache doesn't contain this DN, skipping * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_cache_auth] (0x4000): [RID#145] Offline credentials expiration is [0] days. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [check_failed_login_attempts] (0x4000): [RID#145] Failed login attempts [1], allowed failed login attempts [0], failed login delay [5]. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [check_for_combined_2fa_password] (0x1000): [RID#145] Wrong authtok type. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_cache_auth] (0x0100): [RID#145] Authentication failed. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_ldb_msg_difference] (0x2000): [RID#145] Replaced/extended attr [lastFailedLogin] of entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] * (2026-05-06 12:59:01): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200): [RID#145] Entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] has set [cache, ts_cache] attrs. * (2026-05-06 12:59:01): [be[ipa.domain.com]] [krb5_auth_cache_creds] (0x0020): [RID#145] Offline authentication failed ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-06 12:59:01): [be[ipa.domain.com]] [child_sig_handler] (0x0100): [RID#145] child [4977] finished successfully. sssd_pam/nss.log: (2026-05-06 12:59:01): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#6] CR #21: Data Provider Error: 3, 13, Permission denied (2026-05-06 12:59:01): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#6] CR #23: Data Provider Error: 3, 13, Permission denied
(In reply to Alexey Tikhonov from comment #2) > > > [ipa_dyndns_update_connect_done] (0x0040): Failed to connect to LDAP server: [13](Permission denied) > > > [ipa_subdomains_refresh_connect_done] (0x0020): [RID#5] Unable to connect to LDAP [13]: Permission denied > > > [ipa_subdomains_handler_done] (0x0020): [RID#5] Unable to refresh subdomains [13]: Permission denied > > Probably it's > https://github.com/SSSD/sssd/blob/master/src/providers/ldap/ > sdap_async_connection.c#L2208 That's it: ``` [sdap_cli_resolve_and_connect_kinit_done] (0x0400): [RID#140] Cannot get a TGT: ret [1432158230](Network I/O Error) [sdap_id_op_connect_done] (0x4000): [RID#140] notify error to op #1: 13 [Permission denied] ``` Yet I'm not fully understand: ``` [check_for_combined_2fa_password] (0x1000): [RID#145] Wrong authtok type. [sysdb_cache_auth] (0x0100): [RID#145] Authentication failed. [krb5_auth_cache_creds] (0x0020): [RID#145] Offline authentication failed ```
(In reply to Alexey Tikhonov from comment #4) > ``` > [check_for_combined_2fa_password] (0x1000): [RID#145] Wrong authtok type. > [sysdb_cache_auth] (0x0100): [RID#145] Authentication failed. > [krb5_auth_cache_creds] (0x0020): [RID#145] Offline authentication failed > ``` Did you enter correct password during this test?
Sorry, my bad, tried several times, no difference in login process to verify the password. New logs below: sssd_domain.log * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com] (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#249] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#249] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#249] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#249] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#249] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#249] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#249] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#249] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#249] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#249] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#249] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#249] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#249] sdap_id_op_connect request failed. * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com] (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#250] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#250] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#250] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#250] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#250] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#250] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#250] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#250] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#250] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#250] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#250] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#250] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#250] sdap_id_op_connect request failed. * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=aduser1.com] (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#251] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#251] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#251] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#251] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#251] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#251] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#251] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#251] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#251] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#251] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#251] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#251] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#251] sdap_id_op_connect request failed. * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got request with the following data (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): command: SSS_PAM_PREAUTH (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain: ad.domain.com (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): user: aduser1.com (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): service: plasmalogin (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok type: 0 (No authentication token available) (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available) (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1 (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid: 5224 (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): child_pid: 0 (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon name: not set (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0 (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#252] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#252] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#252] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [child_sig_handler] (0x0100): [RID#252] child [5225] finished successfully. (2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=aduser1.com] (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#253] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#253] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#253] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#253] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#253] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#253] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#253] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#253] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#253] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#253] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#253] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#253] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#253] sdap_id_op_connect request failed. * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got request with the following data (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain: ad.domain.com (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): user: aduser1.com (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): service: plasmalogin (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok type: 1 (Password) (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available) (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1 (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid: 5224 (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): child_pid: 0 (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon name: not set (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0 (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#254] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#254] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#254] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [sysdb_set_entry_attr] (0x0200): [RID#254] Entry [name=aduser1.com,cn=users,cn=ad.domain.com,cn=sysdb] has set [ts_cache] attrs. (2026-05-06 13:36:41): [be[ipa.domain.com]] [sysdb_cache_auth] (0x0100): [RID#254] Hashes do match! (2026-05-06 13:36:41): [be[ipa.domain.com]] [child_sig_handler] (0x0100): [RID#254] child [5226] finished successfully. (2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=pam_usertype_non_existent:@ad.domain.com] (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#255] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#255] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#255] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#255] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#255] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#255] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#255] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#255] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#255] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#255] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#255] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#255] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#255] sdap_id_op_connect request failed. * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=aduser1.com] (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#256] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#256] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#256] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#256] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#256] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#256] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#256] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#256] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#256] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#256] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#256] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#256] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [ipa_subdomain_account_connected] (0x0040): [RID#256] sdap_id_op_connect request failed. * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [dp_pam_handler_send] (0x0100): Got request with the following data (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): domain: ad.domain.com (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): user: aduser1.com (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): service: plasmalogin (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): tty: (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): ruser: (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): rhost: (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): authtok type: 0 (No authentication token available) (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): newauthtok type: 0 (No authentication token available) (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): priv: 1 (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): cli_pid: 5224 (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): child_pid: 0 (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): logon name: not set (2026-05-06 13:36:41): [be[ipa.domain.com]] [pam_print_data] (0x0100): flags: 0 (2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_access_obtain_filter_lists] (0x0200): [RID#257] Deny users list is empty. (2026-05-06 13:36:41): [be[ipa.domain.com]] [sss_parse_name] (0x0200): [RID#257] Domain not provided! (2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_access_obtain_filter_lists] (0x0200): [RID#257] Deny groups list is empty. (2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_access_check_send] (0x0200): [RID#257] Simple access check for aduser1.com (2026-05-06 13:36:41): [be[ipa.domain.com]] [simple_check_get_groups_primary] (0x0200): [RID#257] Could not look up primary group [1346422211]: [2][No such file or directory] (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#258] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#258] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#258] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#258] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#258] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#258] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#258] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#258] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#258] No available servers for service 'IPA' * ... skipping repetitive backtrace ... (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0100): [RID#258] Trying to resolve service 'IPA' (2026-05-06 13:36:41): [be[ipa.domain.com]] [get_port_status] (0x0080): [RID#258] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (2026-05-06 13:36:41): [be[ipa.domain.com]] [fo_resolve_service_send] (0x0020): [RID#258] No available servers for service 'IPA' sssd_nss/pam.log (2026-05-06 13:36:41): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#10] CR #41: Data Provider Error: 3, 13, Permission denied (2026-05-06 13:36:41): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#10] CR #43: Data Provider Error: 3, 13, Permission denied (2026-05-06 13:36:41): [pam] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#10] CR #45: Data Provider Error: 3, 13, Permission denied
Thank you for the logs. > [simple_access_check_send] (0x0200): [RID#257] Simple access check for aduser1.com > [simple_check_get_groups_primary] (0x0200): [RID#257] Could not look up primary group [1346422211]: [2][No such file or directory] This looks like the consequence of the same bug as mentioned in comment 2
Upstream PR: https://github.com/SSSD/sssd/pull/8675
Hi, would you mind to try out scratch build from COPR? sudo dnf copr enable packit/SSSD-sssd-8675 fedora-44-x86_64 sudo dnf upgrade sssd\*
Looks ok - offline mode is operational, no more 'Permission denied' errors.
(In reply to Alexey Tikhonov from comment #8) > Upstream PR: https://github.com/SSSD/sssd/pull/8675 https://github.com/SSSD/sssd/commit/c5b631ee6df531b506d2b2ba7f2d9f0b9de02746 sssd-2-13: https://github.com/SSSD/sssd/pull/8701
(In reply to Alexey Tikhonov from comment #11) > > sssd-2-13: https://github.com/SSSD/sssd/pull/8701 https://github.com/SSSD/sssd/commit/c3acaa3a5104ee32efdb536b311a343276afb5d0
*** Bug 2481235 has been marked as a duplicate of this bug. ***
FEDORA-2026-851bc3ae6a (sssd-2.13.1-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-851bc3ae6a
FEDORA-2026-851bc3ae6a has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-851bc3ae6a` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-851bc3ae6a See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-851bc3ae6a (sssd-2.13.1-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.