Red Hat Bugzilla – Bug 884600
ldap_chpass_uri failover fails on using same hostname
Last modified: 2013-02-21 04:42:10 EST
Description of problem: ldap_chpass_uri failover fails on using same hostname Version-Release number of selected component (if applicable): sssd-1.9.2-30.el6 How reproducible: Always Steps to Reproduce: 1. sssd.conf domain section has: ldap_uri = ldap://ldapserver.example.com:12345,ldap://ldapserver.example.com:389 ldap_chpass_uri = ldap://ldapserver.example.com:12345,ldap://ldapserver.example.com:389 2. Try to change the password of a user # ssh -l puser1 localhostpuser1@localhost's password: Last login: Thu Dec 6 16:11:03 2012 from localhost -sh-4.1$ passwd Changing password for user puser1. Current Password: passwd: Authentication token manipulation error -sh-4.1$ Actual results: Password change fails. Log shows: (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [sdap_pam_chpass_handler] (0x0040): starting password change request for user [puser1]. (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP_CHPASS' (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [get_server_status] (0x1000): Status of server 'ldapserver.example.com' is 'working' (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [get_port_status] (0x1000): Port status of port 12345 for server 'ldapserver.example.com' is 'neutral' (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 10 seconds (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [get_server_status] (0x1000): Status of server 'ldapserver.example.com' is 'working' (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [be_resolve_server_process] (0x0200): Found address for server ldapserver.example.com: [192.168.122.13] TTL 604800 (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [sdap_uri_callback] (0x0400): Constructed uri 'ldap://ldapserver.example.com:12345' (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [sss_ldap_init_send] (0x4000): Using file descriptor [22] for LDAP connection. (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [sss_ldap_init_send] (0x0400): Setting 6 seconds timeout for connecting (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [sdap_async_sys_connect_done] (0x0020): connect failed [111][Connection refused]. (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [sss_ldap_init_sys_connect_done] (0x0020): sdap_async_sys_connect request failed. (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed. (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [sdap_handle_release] (0x2000): Trace: sh[0x13f2a30], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory[0] (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 12345 of server 'ldapserver.example.com' as 'not working' (Thu Dec 6 16:13:46 2012) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Backend returned: (3, 4, <NULL>) [Internal Error (System error)] Expected results: Password change should work. Additional info: Works fine with different hostnames: ldap_chpass_uri = ldap://invalidsrv.example.com,ldap://ldapserver.example.com
Upstream ticket: https://fedorahosted.org/sssd/ticket/1699
Verified in version 1.9.2-59 Report from beaker automation run: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: failover-ldap_chpass_uri_001 Server1 down, Server2 online :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: Stopping LDAP Server on Server1 and sleeping for 1 second :: [ PASS ] :: Authentication successful, as expected :: [ PASS ] :: Running 'auth_success puser1 NewPass_123' :: [ LOG ] :: Starting LDAP Server on Server1 and sleeping for 5 seconds :: [ LOG ] :: Duration: 14s :: [ LOG ] :: Assertions: 2 good, 0 bad :: [ PASS ] :: RESULT: failover-ldap_chpass_uri_001 Server1 down, Server2 online :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: failover-ldap_chpass_uri_002 Failover with single server different ports :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: Sleeping for 5 seconds :: [ PASS ] :: Authentication successful, as expected :: [ PASS ] :: Running 'auth_success puser1 NewPass_123' :: [ LOG ] :: Duration: 11s :: [ LOG ] :: Assertions: 2 good, 0 bad :: [ PASS ] :: RESULT: failover-ldap_chpass_uri_002 Failover with single server different ports :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: failover-ldap_chpass_uri_003 First Server in the list cannot be resolved :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: Sleeping for 5 seconds :: [ PASS ] :: Authentication successful, as expected :: [ PASS ] :: Running 'auth_success puser1 NewPass_123' :: [ LOG ] :: Duration: 11s :: [ LOG ] :: Assertions: 2 good, 0 bad :: [ PASS ] :: RESULT: failover-ldap_chpass_uri_003 First Server in the list cannot be resolved
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0508.html