SSSD / sssd

#104 2 provider = local LDAP BEs configured: Backend returned an error: 3,5(Input/output error),Enum Groups Failed
Closed: Invalid Opened by jgalipea.

Closed: Invalid
Reopen Issue

Description:
With two LDAP back ends configured with provide = ldap, getting -[[BR]]
Backend returned an error: 3,5(Input/output error),Enum Groups Failed on second LDAP server[[BR]]

Version:
sssd-2009081214-0.fc11.i586

Debug:

[sssd[nss]] [nss_cmd_setgrent_ext] (4): Requesting info for all groups
[sssd[nss]] [nss_dp_send_acct_req] (4): Sending request for [EXAMPLE.COM][2][core][name=*]
[sssd[dp]] [dp_get_account_info] (4): Got request for [EXAMPLE.COM][2][core][name=*]
[sssd[dp]] [dp_send_acct_req] (4): Sending request for [2][core][name=*]
[sssd[be[ldap]]] [sbus_dispatch] (6): dbus conn: 9660188
[sssd[be[ldap]]] [sbus_dispatch] (6): Dispatching.
[sssd[be[ldap]]] [sbus_message_handler] (9): Received SBUS method [getAccountInfo]
[sssd[be[ldap]]] [be_get_account_info] (4): Got request for [2][core][name=*]
[sssd[be[ldap]]] [ldb] (9): start ldb transaction (nesting: 0)
[sssd[be[ldap]]] [sdap_get_groups_transaction] (5): calling ldap_search_ext with [(&(cn=*)(objectclass=posixGroup))].
[sssd[be[ldap]]] [sdap_get_groups_transaction] (8): ldap_search_ext called, msgid = 3
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x9661578], connected[1], ops[0x9662440], fde[0x9661268], ldap[0x9662c90]
[sssd[be[ldap]]] [sdap_save_group_send] (6): Storing info for group Group1
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x9661578], connected[1], ops[0x9662440], fde[0x9661268], ldap[0x9662c90]
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x9661578], connected[1], ops[0x9662440], fde[0x9661268], ldap[0x9662c90]
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x9661578], connected[1], ops[0x9662440], fde[0x9661268], ldap[0x9662c90]
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x9661578], connected[1], ops[0x9662440], fde[0x9661268], ldap[0x9662c90]
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x9661578], connected[1], ops[0x9662440], fde[0x9661268], ldap[0x9662c90]
[sssd[be[ldap]]] [sdap_save_group_send] (6): Storing info for group Group2
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x9661578], connected[1], ops[0x9662440], fde[0x9661268], ldap[0x9662c90]
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[ldap]]] [sdap_save_group_send] (6): Storing info for group Group3
[sssd[be[ldap]]] [sysdb_add_group_send] (2): Supplied gid [999] is not in the allowed range [1000-1010].
[sssd[be[ldap]]] [sdap_save_group_send] (6): Storing info for group Group4
[sssd[be[ldap]]] [sysdb_add_group_send] (2): Supplied gid [1011] is not in the allowed range [1000-1010].
[sssd[be[ldap]]] [sdap_save_group_send] (6): Storing info for group Duplicate
[sssd[be[ldap]]] [sdap_get_groups_done] (3): Search result: Success(0), (null)
[sssd[be[ldap]]] [ldb] (9): commit ldb transaction (nesting: 0)
[sssd[be[ldap]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success
[sssd[dp]] [be_got_account_info] (4): Got reply (0, 0, Success) from ldap(EXAMPLE.COM)
[sssd[nss]] [nss_dp_get_reply] (4): Got reply (0, 0, Success) from Data Provider
[sssd[nss]] [nss_dp_send_acct_req] (4): Sending request for [BOS.REDHAT.COM][2][core][name=*]
[sssd[dp]] [dp_get_account_info] (4): Got request for [BOS.REDHAT.COM][2][core][name=*]
[sssd[dp]] [dp_send_acct_req] (4): Sending request for [2][core][name=*]
[sssd[be[ldap]]] [sbus_dispatch] (6): dbus conn: 894BDF8
[sssd[be[ldap]]] [sbus_dispatch] (6): Dispatching.
[sssd[be[ldap]]] [sbus_message_handler] (9): Received SBUS method [getAccountInfo]
[sssd[be[ldap]]] [be_get_account_info] (4): Got request for [2][core][name=*]
[sssd[be[ldap]]] [ldb] (9): start ldb transaction (nesting: 0)
[sssd[be[ldap]]] [sdap_get_groups_transaction] (5): calling ldap_search_ext with [(&(cn=*)(objectclass=posixGroup))].
[sssd[be[ldap]]] [sdap_get_groups_transaction] (8): ldap_search_ext called, msgid = 3
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x894f028], connected[1], ops[0x894c110], fde[0x894e2f0], ldap[0x894e7b8]
[sssd[be[ldap]]] [sdap_save_group_send] (6): Storing info for group group2000
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x894f028], connected[1], ops[0x894c110], fde[0x894e2f0], ldap[0x894e7b8]
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x894f028], connected[1], ops[0x894c110], fde[0x894e2f0], ldap[0x894e7b8]
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x894f028], connected[1], ops[0x894c110], fde[0x894e2f0], ldap[0x894e7b8]
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: sh[0x894f028], connected[1], ops[0x894c110], fde[0x894e2f0], ldap[0x894e7b8]
[sssd[be[ldap]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[ldap]]] [ldb] (9): cancel ldb transaction (nesting: 0)
[sssd[be[ldap]]] [acctinfo_callback] (4): Request processed. Returned 3,5,Enum Groups Failed
[sssd[dp]] [be_got_account_info] (4): Got reply (3, 5, Enum Groups Failed) from ldap(BOS.REDHAT.COM)
[sssd[dp]] [be_got_account_info] (1): Backend returned an error: 3,5(Input/output error),Enum Groups Failed
[sssd[nss]] [nss_dp_get_reply] (4): Got reply (0, 0, Success) from Data Provider
[sssd[nss]] [nss_cmd_getgrent] (4): Requesting info for all groups
[sssd[nss]] [nss_cmd_getgrent] (4): Requesting info for all groups
[sssd[nss]] [nss_cmd_endgrent] (4): Terminating request info for all groups

Configuration:

[services]
description =  Local Service Configuration
activeServices = nss, pam
reconnection_retries = 3
[services/nss]
description = NSS Responder Configuration
filterGroups = root
filterUsers = root
debug-level = 4
[services/dp]
description = Data Provider Configuration
debug-level = 4
[services/pam]
description = PAM Responder Configuration
[services/monitor]
description = Service Monitor Configuration
[domains]
description = Domains served by SSSD
domains = EXAMPLE.COM,BOS.REDHAT.COM
[domains/EXAMPLE.COM]
description = Request to our EXAMPLE.COM LDAP server
enumerate = 3
minId = 1000
maxId = 1010
cache-credentials = FALSE
provider = ldap
ldapUri = ldap://jennyv4.bos.redhat.com:389
userSearchBase = ou=people,dc=example,dc=com
groupSearchBase = ou=groups,dc=example,dc=com
[domains/BOS.REDHAT.COM]
description = Request to our BOS.REDHAT.COM LDAP server
enumerate = 3
minId = 2000
maxId = 2010
cache-credentials = FALSE
provider = ldap
ldapUri = ldap://jennyv4.bos.redhat.com:11329
userSearchBase = ou=people,dc=bos,dc=redhat,dc=com
groupSearchBase = ou=groups,dc=bos,dc=redhat,dc=com

Posix Groups in BOS.REDHAT.COM realm:

# group2000, Groups, bos.redhat.com
dn: cn=group2000,ou=Groups, dc=bos,dc=redhat,dc=com
gidNumber: 2000
objectClass: top
objectClass: posixgroup
cn: group2000
memberUid: 2000
memberUid: 2009
memberUid: foo,bar,baz
# Group1000, Groups, bos.redhat.com
dn: cn=Group1000,ou=Groups, dc=bos,dc=redhat,dc=com
gidNumber: 1000
objectClass: top
objectClass: posixgroup
cn: Group1000
memberUid: 1000
memberUid: 2000
# Duplicate, Groups, bos.redhat.com
dn: cn=Duplicate,ou=Groups, dc=bos,dc=redhat,dc=com
gidNumber: 2010
objectClass: top
objectClass: posixgroup
cn: Duplicate

Fields changed

summary: 2 LDAP BEs configured: Backend returned an error: 3,5(Input/output error),Enum Groups Failed => 2 proxy = local LDAP BEs configured: Backend returned an error: 3,5(Input/output error),Enum Groups Failed

Fields changed

summary: 2 proxy = local LDAP BEs configured: Backend returned an error: 3,5(Input/output error),Enum Groups Failed => 2 provider = local LDAP BEs configured: Backend returned an error: 3,5(Input/output error),Enum Groups Failed

Note: no groups are ever returned.

priority: major => critical

This is a serious bug and should be resolved by 0.5.0

component: SSSD => LDAP Provider
milestone: SSSD 1.0 => Iteration 6
owner: somebody => simo
priority: critical => blocker

Distributing the workload a bit. Passing this bug to Sumit.

owner: simo => sbose

Please add

legacy = TRUE

to [domains/BOS.REDHAT.COM] and maybe to [domains/EXAMPLE.COM].

When using the attribute memberUID to list the uids of the group members (instead of using the member attribute which will use the user's DN) 'legacy = TRUE' must be set.

resolution: => invalid
status: new => closed

Fields changed

rhbz: => 0

Metadata Update from @jgalipea:
- Issue assigned to sbose
- Issue set to the milestone: SSSD 0.5.0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1146

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Lowest
defect
LDAP Provider
master
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.