694444 – Unable to resolve SRV record when called with _srv_,<fixed ldap uri> in ldap_uri

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 694444 - Unable to resolve SRV record when called with _srv_,<fixed ldap uri> in ldap_uri

Summary: Unable to resolve SRV record when called with _srv_,<fixed ldap uri> in ldap_uri

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	sssd
Sub Component:
Version:	6.1
Hardware:	Unspecified
OS:	Linux
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	Stephen Gallagher
QA Contact:	Chandrasekar Kannan
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	695476
TreeView+	depends on / blocked

Reported:	2011-04-07 11:29 UTC by Kaushik Banerjee
Modified:	2015-01-04 23:47 UTC (History)
CC List:	8 users (show)
Fixed In Version:	sssd-1.5.1-26.el6
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Clones:	695476 (view as bug list)
Environment:
Last Closed:	2011-05-19 11:39:22 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:0560	0	normal	SHIPPED_LIVE	Low: sssd security, bug fix, and enhancement update	2011-05-19 11:38:17 UTC

Description Kaushik Banerjee 2011-04-07 11:29:28 UTC

Description of problem:
Unable to resolve SRV record when called with _srv_,<fixed ldap uri> in ldap_uri

Version-Release number of selected component (if applicable):
sssd-1.5.1-24.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Create an approrpiate SRV record entry in DNS Server for domain sssdad.com "_ldap._tcp IN SRV 0 0 389 pluto".
2. Verify that lookup happens with the command "dig SRV _ldap._tcp.sssdad.com"
3. Configure sssd to use both SRV and fixed ldap_uri. Use dns_discovery_domain for appropriate domain name for the SRV query. See additional info for relevant sssd.conf.
  
Actual results:
sssd fails to resolve the SRV record. 

/var/log/sssd/sssd_AD.log
<snip>
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [fo_resolve_service_send] (4): Trying to resolve service 'LDAP'
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [get_port_status] (7): Port status of port 0 for server '(no name)' is 'neutral'
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [resolve_srv_send] (6): The status of SRV lookup is neutral
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [resolve_srv_cont] (4): Searching for servers via SRV query '_ldap._tcp.sssdad.com'
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [resolv_getsrv_send] (4): Trying to resolve SRV record of '_ldap._tcp.sssdad.com'
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [schedule_timeout_watcher] (9): Scheduling DNS timeout watcher
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [unschedule_timeout_watcher] (9): Unscheduling DNS timeout watcher
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [set_srv_data_status] (4): Marking SRV lookup of service 'LDAP' as 'not resolved'
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [be_resolve_server_done] (6): Couldn't resolve server (SRV lookup meta-server), resolver returned (5)
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [be_resolve_server_done] (6): Trying with the next one!
(Thu Apr  7 16:51:31 2011) [sssd[be[AD]]] [fo_resolve_service_send] (4): Trying to resolve service 'LDAP'
</snip>

Expected results:
sssd should resolve the SRV record.

Additional info:
# cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = AD
debug_level = 9

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
debug_level = 9

[pam]
reconnection_retries = 3
debug_level = 9

[domain/AD]
description = LDAP domain with AD server
debug_level = 9
enumerate = false
cache_credentials = False
id_provider = ldap
ldap_id_use_start_tls = true
auth_provider = ldap
ldap_uri = _srv_,ldap://pluto.sssdad.com
dns_discovery_domain = sssdad.com
ldap_schema = rfc2307bis
ldap_default_bind_dn = cn=Administrator,cn=Users,dc=sssdad,dc=com
ldap_default_authtok_type = password
ldap_default_authtok = redhat_123
ldap_search_base = dc=sssdad,dc=com
ldap_user_object_class = person
ldap_user_name = uid
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_user_principal = userPrincipalName
ldap_group_object_class = group
ldap_group_name = cn
ldap_force_upper_case_realm = True

Comment 3 RHEL Program Management 2011-04-07 11:43:52 UTC

Since RHEL 6.1 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.

Comment 4 Jakub Hrozek 2011-04-07 12:04:21 UTC

Upstream bug:
https://fedorahosted.org/sssd/ticket/839

Comment 8 Kaushik Banerjee 2011-04-12 14:51:05 UTC

Verified that SRV record is appropriately resolved when called with _srv_,<fixed ldap uri> in ldap_uri.

output from /var/log/sssd/sssd_AD.log:
<snip>
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [fo_resolve_service_send] (4): Trying to resolve service 'LDAP'
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [get_port_status] (7): Port status of port 0 for server '(no name)' is 'neutral'
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [resolve_srv_send] (6): The status of SRV lookup is neutral
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [resolve_srv_cont] (4): Searching for servers via SRV query '_ldap._tcp.sssdad.com'
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [resolv_getsrv_send] (4): Trying to resolve SRV record of '_ldap._tcp.sssdad.com'
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [schedule_timeout_watcher] (9): Scheduling DNS timeout watcher
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [unschedule_timeout_watcher] (9): Unscheduling DNS timeout watcher
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [resolve_srv_done] (6): Inserted server 'pluto.sssdad.com:389' for service LDAP
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [set_srv_data_status] (4): Marking SRV lookup of service 'LDAP' as 'resolved'
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [get_server_status] (7): Status of server 'pluto.sssdad.com' is 'name not resolved'
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [get_server_status] (4): Hostname resolution expired, reseting the server status of 'pluto.sssdad.com'
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [set_server_common_status] (4): Marking server 'pluto.sssdad.com' as 'name not resolved'
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [resolv_gethostbyname_send] (4): Trying to resolve A record of 'pluto.sssdad.com'
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [schedule_timeout_watcher] (9): Scheduling DNS timeout watcher
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [set_server_common_status] (4): Marking server 'pluto.sssdad.com' as 'resolving name'
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [unschedule_timeout_watcher] (9): Unscheduling DNS timeout watcher
(Tue Apr 12 20:13:33 2011) [sssd[be[AD]]] [set_server_common_status] (4): Marking server 'pluto.sssdad.com' as 'name resolved'
</snip>

Verified in version:
# rpm -qi sssd | head
Name        : sssd                         Relocations: (not relocatable)
Version     : 1.5.1                             Vendor: Red Hat, Inc.
Release     : 27.el6                        Build Date: Tue 12 Apr 2011 07:10:31 PM IST
Install Date: Tue 12 Apr 2011 07:43:30 PM IST      Build Host: hs20-bc2-3.build.redhat.com
Group       : Applications/System           Source RPM: sssd-1.5.1-27.el6.src.rpm
Size        : 3462773                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://fedorahosted.org/sssd/
Summary     : System Security Services Daemon

Comment 9 errata-xmlrpc 2011-05-19 11:39:22 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0560.html

Comment 10 errata-xmlrpc 2011-05-19 13:03:58 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0560.html

Note You need to log in before you can comment on or make changes to this bug.