RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 803842 - Unable to bind to LDAP server when minssf set
Summary: Unable to bind to LDAP server when minssf set
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sssd
Version: 6.3
Hardware: All
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Stephen Gallagher
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On: 803436
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-03-15 18:25 UTC by Stephen Gallagher
Modified: 2020-05-04 10:31 UTC (History)
9 users (show)

Fixed In Version: sssd-1.8.0-17.el6
Doc Type: Bug Fix
Doc Text:
No technical note required
Clone Of: 803436
Environment:
Last Closed: 2012-06-20 11:56:02 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 2299 0 None None None 2020-05-04 10:31:15 UTC
Red Hat Product Errata RHBA-2012:0747 0 normal SHIPPED_LIVE sssd bug fix and enhancement update 2012-06-19 19:31:43 UTC

Description Stephen Gallagher 2012-03-15 18:25:47 UTC 
+++ This bug was initially created as a clone of Bug #803436 +++

Description of problem:
I changed the configuration of my IPA server and set minssf to 56, as is documented n the IPA guide. All my RHEL based systems continue to function. But my one fedora desktop is now unable to bind to the server, and as such is not getting any updated information. 

From the logs:
Unexpected result from ldap: Server is unwilling to perform(53), Minimum SSF not met.


Version-Release number of selected component (if applicable):
sssd-1.8.0-6.fc16.x86_64

How reproducible:
set minssf on server, watch sssd fail to bind. Frankly with all the caching that goes on I wouldn't have even noticed that it wasn't working except for a password change that arose after minssf was set. 

As I said this continues to work fine in RHEL 5 and 6, so chances are this is something new or a bugfix that wasn't forward ported.

-Erinn

--- Additional comment from sgallagh on 2012-03-15 13:47:41 EDT ---

Upstream ticket:
https://fedorahosted.org/sssd/ticket/1257

--- Additional comment from sgallagh on 2012-03-15 14:03:24 EDT ---

Ok, it turns out that there are two bugs at play here.

The first is a 389-DS bug: https://fedorahosted.org/389/ticket/168
Basically, when setting the minssf to 56, it prevents SSSD from being able to read the RootDSE (that contains some basic information about the LDAP server's capabilities). In SSSD 1.5.x (aka RHEL 5.8 and 6.2) we had a bug that was coincidentally working in your favor. We weren't throwing an error at one particular point, and instead we continued on.

Just by pure luck, this would work fine with SSSD as long as enumerate = false (it could result in some unfortunate behavior with enumerate=true).

In SSSD 1.8.x, we fixed the error so that now the RootDSE is failing loudly instead of silently. In the average (non-IPA) case, we should be allowing it to just continue on, and we're submitting a patch upstream to do that. This will result in you continuing to see the behavior you saw on 1.5.x.

But the correct long-term fix is for https://fedorahosted.org/389/ticket/168 to be fixed (and for you to set the nsslapd-minssf-exclude-rootdse option.
Comment 1 Stephen Gallagher 2012-03-15 18:28:13 UTC 
Updating summary. This is not exclusive to IPA.
Comment 3 Erinn Looney-Triggs 2012-03-21 19:27:14 UTC 
Thanks for the detailed info, any idea when 389 will be updated in RHEL 6 so that I can set the nsslapd-minssf-exclude-rootdse option?

-Erinn
Comment 4 Stephen Gallagher 2012-03-22 12:20:35 UTC 
(In reply to comment #3)
> Thanks for the detailed info, any idea when 389 will be updated in RHEL 6 so
> that I can set the nsslapd-minssf-exclude-rootdse option?
> 
> -Erinn

I don't personally know. I'd strongly suggest speaking to your support representative and opening a case with them. That will go a long way towards setting the proper priority for the 389 team.
Comment 5 Stephen Gallagher 2012-04-10 16:51:01 UTC 
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
No technical note required
Comment 7 Kaushik Banerjee 2012-04-26 06:55:09 UTC 
Verified in version:

# rpm -qi sssd | head
Name        : sssd                         Relocations: (not relocatable)
Version     : 1.8.0                             Vendor: Red Hat, Inc.
Release     : 23.el6                        Build Date: Fri 20 Apr 2012 11:30:39 PM IST
Install Date: Wed 25 Apr 2012 07:28:48 PM IST      Build Host: x86-003.build.bos.redhat.com
Group       : Applications/System           Source RPM: sssd-1.8.0-23.el6.src.rpm
Size        : 7874744                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://fedorahosted.org/sssd/
Summary     : System Security Services Daemon
Comment 9 errata-xmlrpc 2012-06-20 11:56:02 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0747.html
Note You need to log in before you can comment on or make changes to this bug.