Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
"Unknown (private extension) error(21853), (null)" messages are logged during change password operation of a user in openldap server with ppolicy enabled.
Cause: SSSD uses a private LDAP error code, because there are no official ones for error conditions indicated by the server side password policies.
Consequence: Very generic and thus not understandable error messages were printed when this error occurred.
Fix: A routine detecting and translating this error code has been implemented.
Result: A clear error message is printed to log when the error occurs.
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
Cause: SSSD uses a private LDAP error code, because there are no official ones for error conditions indicated by the server side password policies.
Consequence: Very generic and thus not understandable error messages were printed when this error occurred.
Fix: A routine detecting and translating this error code has been implemented.
Result: A clear error message is printed to log when the error occurs.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
http://rhn.redhat.com/errata/RHBA-2011-1529.html
Description of problem: "Unknown (private extension) error(21853), (null)" messages are logged during change password operation of a user in openldap server with ppolicy enabled. Version-Release number of selected component (if applicable): sssd-1.5.1-49.el6 How reproducible: Always Steps to Reproduce: 1. Setup ppolicy on openldap server. # cat /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}bdb/olcOverlay\=\{1\}ppolicy.ldif dn: olcOverlay={1}ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {1}ppolicy olcPPolicyDefault: cn=Standard Policy,ou=Policies,dc=example,dc=com olcPPolicyUseLockout: TRUE structuralObjectClass: olcPPolicyConfig entryUUID: 3142c552-5cc4-1030-94ec-59a8a4130303 creatorsName: cn=admin,cn=config createTimestamp: 20110817022726Z entryCSN: 20110817022726.691621Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20110817022726Z dn: cn=Standard Policy,ou=Policies,dc=example,dc=com objectClass: device objectClass: pwdPolicy pwdAttribute: userPassword pwdLockoutDuration: 0 pwdInHistory: 6 pwdCheckQuality: 2 pwdExpireWarning: 1000 pwdMaxAge: 30000 pwdMinLength: 5 pwdGraceAuthNLimit: 3 pwdAllowUserChange: TRUE pwdMustChange: TRUE pwdMaxFailure: 3 pwdFailureCountInterval: 0 pwdSafeModify: TRUE pwdLockout: TRUE cn: Standard Policy 2. Add a user: dn: uid=ppuser1,dc=example,dc=com objectClass: account objectClass: posixAccount objectClass: pwdPolicy cn: ppolicy test user 1 uidNumber: 564675 gidNumber: 564675 homeDirectory: /home/ppuser1 pwdAttribute: userPassword uid: ppuser1 userPassword:: e1NTSEF9akJXbnlTRDFHcWtwdjFJQWFvdHEvc2l3N1lsUHdCc2c= 3. Force password reset for the user: # ldapmodify -x -D "cn=Manager,dc=example,dc=com" -w Secret123 <<EOF dn: uid=ppuser1,dc=example,dc=com changetype: modify add: pwdReset pwdReset: TRUE EOF modifying entry "uid=ppuser1,dc=example,dc=com" 4. Auth as the user: # ssh -l ppuser1 localhost ppuser1@localhost's password: Password expired. Change your password now. Last login: Tue Aug 30 13:04:09 2011 from localhost WARNING: Your password has expired. You must change your password now and login again! Changing password for user ppuser1. Current Password: New password: Actual results: Functionally this works as expected. However, the log returns: [simple_bind_done] (3): Bind result: Unknown (private extension) error(21853), (null) /var/log/sssd/sssd_LDAP.log shows: <snip> (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=ppuser1,dc=example,dc=com (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2 (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1415c00], connected[1], ops[0x13fb9c0], ldap[0x1370620] (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1415c00], connected[1], ops[0x13fb9c0], ldap[0x1370620] (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1415c00], connected[1], ops[0x13fb9c0], ldap[0x1370620] (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [simple_bind_done] (9): Server returned control [1.3.6.1.4.1.42.2.27.8.5.1]. (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [simple_bind_done] (7): Password Policy Response: expire [-1] grace [-1] error [Password must be changed]. (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [simple_bind_done] (4): Password was reset. User must set a new password. (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [simple_bind_done] (3): Bind result: Unknown (private extension) error(21853), (null) (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [auth_bind_user_done] (9): Found ppolicy data, assuming LDAP password policies are active. (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [sdap_auth4chpass_done] (9): Initial authentication for change password operation successful. (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (0, 0, <NULL>) [Success] (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sending result [0][LDAP] (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sent result [0][LDAP] (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [sdap_handle_release] (8): Trace: sh[0x1415c00], connected[1], ops[(nil)], ldap[0x1370620], destructor_lock[0], release_memory[0] (Tue Aug 30 13:06:04 2011) [sssd[be[LDAP]]] [remove_connection_callback] (9): Successfully removed connection callback. </snip> Expected results: Improve error message logging of the private error codes. Additional info: