Hide Forgot
It looks like there's a bug somewhere while chasing referrals with an authenticated bind. I'm not certain yet whether it is SSSD's bug or OpenLDAP's bug, but it will become irrelevant when we resolve https://fedorahosted.org/sssd/ticket/860 (which is a complete rewrite of the referral code) In the meantime, you can mitigate this issue by setting ldap_referrals = false in the [domain/default] section of your sssd.conf. This will disable referral-following, so if you rely on referrals (e.g. you are using partial replication), it may not help. However, from the logs I can see you're talking to AD, which uses referrals automatically in many places, despite having no need to do so. I'd say there's a fair chance this will work for you as a workaround until we fix the above ticket.