SSSD / sssd

#279 sssd 0.7.1-1 fails when changing password
Closed: Fixed Opened by sejeff.

Closed: Fixed
Reopen Issue

A user was complaining about not being able to change their password on one of our sssd client servers in the lab. passwd was failing with "System Error". I was able to reproduce it once after about 10 password changes but wasn't running sssd in debug mode at the time.

It looks like this:

jschroeder@someserver: ~ $ passwd
Changing password for user jschroeder.
Password: 
New UNIX password: 
Retype new UNIX password: 
passwd: System error

Working

[sssd[be[LDAP]]] [sbus_message_handler] (9): Received SBUS method [pamHandler]
[sssd[be[LDAP]]] [be_pam_handler] (4): Got request with the following data
[sssd[be[LDAP]]] [pam_print_data] (4): command: 246
[sssd[be[LDAP]]] [pam_print_data] (4): domain: LDAP
[sssd[be[LDAP]]] [pam_print_data] (4): user: jschroeder
[sssd[be[LDAP]]] [pam_print_data] (4): service: passwd
[sssd[be[LDAP]]] [pam_print_data] (4): tty: pts/34
[sssd[be[LDAP]]] [pam_print_data] (4): ruser:
[sssd[be[LDAP]]] [pam_print_data] (4): rhost:
[sssd[be[LDAP]]] [pam_print_data] (4): authtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): authtok size: 8
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok size: 11
[sssd[be[LDAP]]] [pam_print_data] (4): priv: 0
[sssd[be[LDAP]]] [pam_print_data] (4): pw_uid: 7084
[sssd[be[LDAP]]] [pam_print_data] (4): gr_gid: 100
[sssd[be[LDAP]]] [pam_print_data] (4): cli_pid: 32471
[sssd[be[LDAP]]] [sdap_pam_chpass_handler] (2): starting password change request for user [jschroeder].
[sssd[be[LDAP]]] [sdap_connect_send] (4): Executing START TLS
[sssd[be[LDAP]]] [sdap_install_ldap_callbacks] (8): Trace: sh[0xc8d8c0], connected[1], ops[(nil)], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xc96bd0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_connect_done] (3): START TLS result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[(nil)], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[LDAP]]] [find_password_expiration_attributes] (9): No password expiration attributes found.
[sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=jschroeder,ou=People,o=int
[sssd[be[LDAP]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xc9fdf0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [simple_bind_done] (5): Server returned no controls.
[sssd[be[LDAP]]] [simple_bind_done] (3): Bind result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_auth4chpass_done] (7): user [uid=jschroeder,ou=People,o=int] successfully authenticated.
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (4): Executing extended operation
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (8): ldap_extended_operation sent, msgid = 3
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xcc12e0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xcc12e0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (5): Server returned no controls.
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (3): ldap_extended_operation result: Success(0), (null)
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (0, 0, <NULL>) [Success]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sending result [0][LDAP]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sent result [0][LDAP]
[sssd[pam]] [sbus_remove_timeout] (8): [sssd[be[LDAP]]] [sdap_handle_release] (8): 0x13d1660
[sssd[pam]] [sbus_dispatch] (6): dbus conn: 13D27E0
[sssd[pam]] [sbus_dispatch] (6): Dispatching.
[sssd[pam]] [pam_dp_process_reply] (4): received: [0][LDAP]
[sssd[pam]] [pam_reply] (4): pam_reply get called.
[sssd[pam]] [pam_reply] (4): blen: 21
Trace: sh[0xc8d8c0], connected[1], ops[(nil)], fde[0xc96ab0], ldap[0xc96760]
[sssd[pam]] [client_recv] (5): Client disconnected!
[sssd[nss]] [client_recv] (5): Client disconnected!

Not working

[sssd[be[LDAP]]] [sbus_message_handler] (9): Received SBUS method [pamHandler]
[sssd[be[LDAP]]] [be_pam_handler] (4): Got request with the following data
[sssd[be[LDAP]]] [pam_print_data] (4): command: 246
[sssd[be[LDAP]]] [pam_print_data] (4): domain: LDAP
[sssd[be[LDAP]]] [pam_print_data] (4): user: somerandomuser
[sssd[be[LDAP]]] [pam_print_data] (4): service: passwd
[sssd[be[LDAP]]] [pam_print_data] (4): tty: pts/32
[sssd[be[LDAP]]] [pam_print_data] (4): ruser:
[sssd[be[LDAP]]] [pam_print_data] (4): rhost:
[sssd[be[LDAP]]] [pam_print_data] (4): authtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): authtok size: 10
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok size: 12
[sssd[be[LDAP]]] [pam_print_data] (4): priv: 0
[sssd[be[LDAP]]] [pam_print_data] (4): pw_uid: 7111
[sssd[be[LDAP]]] [pam_print_data] (4): gr_gid: 100
[sssd[be[LDAP]]] [pam_print_data] (4): cli_pid: 10102
[sssd[be[LDAP]]] [sdap_pam_chpass_handler] (2): starting password change request for user [somerandomuser].
[sssd[be[LDAP]]] [sdap_connect_send] (4): Executing START TLS
[sssd[be[LDAP]]] [sdap_install_ldap_callbacks] (8): Trace: sh[0x1b82e60], connected[1], ops[(nil)], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1b82e60], connected[1], ops[0x1b8c1a0], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [sdap_connect_done] (3): START TLS result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1b82e60], connected[1], ops[(nil)], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[LDAP]]] [find_password_expiration_attributes] (9): Found shadow password expiration attributes.
[sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=somerandomuser,ou=People,o=int
[sssd[be[LDAP]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1b82e60], connected[1], ops[0x1b82d60], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [simple_bind_done] (5): Server returned no controls.
[sssd[be[LDAP]]] [simple_bind_done] (3): Bind result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_auth4chpass_done] (7): user [uid=somerandomuser,ou=People,o=int] successfully authenticated.
[sssd[be[LDAP]]] [sdap_auth4chpass_done] (1): Changing shadow password attributes not implemented.
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (3, 4, <NULL>) [Internal Error (Success)]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sending result [4][LDAP]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sent result [4][LDAP]
[sssd[be[LDAP]]] [sdap_handle_release] (8): Trace: sh[0x1b82e60], connected[1], ops[(nil)], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[pam]] [sbus_remove_timeout] (8): 0x21ff260
[sssd[pam]] [sbus_dispatch] (6): dbus conn: 22007E0
[sssd[pam]] [sbus_dispatch] (6): Dispatching.
[sssd[pam]] [pam_dp_process_reply] (4): received: [4][LDAP]
[sssd[pam]] [pam_reply] (4): pam_reply get called.
[sssd[pam]] [pam_reply] (4): blen: 21
[sssd[nss]] [client_recv] (5): Client disconnected!
[sssd[pam]] [client_recv] (5): Client disconnected!

========== sssd.conf =========

[sssd]
config_file_version = 2
domains = LDAP
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
[nss]
filter_groups = root,core
filter_users = root,core
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/LDAP]
auth_provider = ldap
cache_credentials = TRUE
chpass_provider = ldap
enumerate = TRUE
id_provider = ldap
ldap_group_search_base = ou=Groups,o=int
ldap_tls_reqcert = never
ldap_uri = ldap://server1.site1 ldap://server2.site2 ldap://server3.site3
ldap_user_search_base = o=int
min_id = 1
timeout = 60

Fields changed

component: SSSD => LDAP Provider
description: A user was complaining about not being able to change their password on one of our sssd client servers in the lab. passwd was failing with "System Error". I was able to reproduce it once after about 10 password changes but wasn't running sssd in debug mode at the time.

It looks like this:
jschroeder@someserver: ~ $ passwd
Changing password for user jschroeder.
Password:
New UNIX password:
Retype new UNIX password:
passwd: System error

Working

[sssd[be[LDAP]]] [sbus_message_handler] (9): Received SBUS method [pamHandler]
[sssd[be[LDAP]]] [be_pam_handler] (4): Got request with the following data
[sssd[be[LDAP]]] [pam_print_data] (4): command: 246
[sssd[be[LDAP]]] [pam_print_data] (4): domain: LDAP
[sssd[be[LDAP]]] [pam_print_data] (4): user: jschroeder
[sssd[be[LDAP]]] [pam_print_data] (4): service: passwd
[sssd[be[LDAP]]] [pam_print_data] (4): tty: pts/34
[sssd[be[LDAP]]] [pam_print_data] (4): ruser:
[sssd[be[LDAP]]] [pam_print_data] (4): rhost:
[sssd[be[LDAP]]] [pam_print_data] (4): authtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): authtok size: 8
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok size: 11
[sssd[be[LDAP]]] [pam_print_data] (4): priv: 0
[sssd[be[LDAP]]] [pam_print_data] (4): pw_uid: 7084
[sssd[be[LDAP]]] [pam_print_data] (4): gr_gid: 100
[sssd[be[LDAP]]] [pam_print_data] (4): cli_pid: 32471
[sssd[be[LDAP]]] [sdap_pam_chpass_handler] (2): starting password change request for user [jschroeder].
[sssd[be[LDAP]]] [sdap_connect_send] (4): Executing START TLS
[sssd[be[LDAP]]] [sdap_install_ldap_callbacks] (8): Trace: sh[0xc8d8c0], connected[1], ops[(nil)], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xc96bd0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_connect_done] (3): START TLS result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[(nil)], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[LDAP]]] [find_password_expiration_attributes] (9): No password expiration attributes found.
[sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=jschroeder,ou=People,o=int
[sssd[be[LDAP]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xc9fdf0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [simple_bind_done] (5): Server returned no controls.
[sssd[be[LDAP]]] [simple_bind_done] (3): Bind result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_auth4chpass_done] (7): user [uid=jschroeder,ou=People,o=int] successfully authenticated.
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (4): Executing extended operation
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (8): ldap_extended_operation sent, msgid = 3
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xcc12e0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xcc12e0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (5): Server returned no controls.
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (3): ldap_extended_operation result: Success(0), (null)
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (0, 0, ) [Success]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sending result [0][LDAP]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sent result [0][LDAP]
[sssd[pam]] [sbus_remove_timeout] (8): [sssd[be[LDAP]]] [sdap_handle_release] (8): 0x13d1660
[sssd[pam]] [sbus_dispatch] (6): dbus conn: 13D27E0
[sssd[pam]] [sbus_dispatch] (6): Dispatching.
[sssd[pam]] [pam_dp_process_reply] (4): received: [0][LDAP]
[sssd[pam]] [pam_reply] (4): pam_reply get called.
[sssd[pam]] [pam_reply] (4): blen: 21
Trace: sh[0xc8d8c0], connected[1], ops[(nil)], fde[0xc96ab0], ldap[0xc96760]
[sssd[pam]] [client_recv] (5): Client disconnected!
[sssd[nss]] [client_recv] (5): Client disconnected!

Not working

[sssd[be[LDAP]]] [sbus_message_handler] (9): Received SBUS method [pamHandler]
[sssd[be[LDAP]]] [be_pam_handler] (4): Got request with the following data
[sssd[be[LDAP]]] [pam_print_data] (4): command: 246
[sssd[be[LDAP]]] [pam_print_data] (4): domain: LDAP
[sssd[be[LDAP]]] [pam_print_data] (4): user: somerandomuser
[sssd[be[LDAP]]] [pam_print_data] (4): service: passwd
[sssd[be[LDAP]]] [pam_print_data] (4): tty: pts/32
[sssd[be[LDAP]]] [pam_print_data] (4): ruser:
[sssd[be[LDAP]]] [pam_print_data] (4): rhost:
[sssd[be[LDAP]]] [pam_print_data] (4): authtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): authtok size: 10
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok size: 12
[sssd[be[LDAP]]] [pam_print_data] (4): priv: 0
[sssd[be[LDAP]]] [pam_print_data] (4): pw_uid: 7111
[sssd[be[LDAP]]] [pam_print_data] (4): gr_gid: 100
[sssd[be[LDAP]]] [pam_print_data] (4): cli_pid: 10102
[sssd[be[LDAP]]] [sdap_pam_chpass_handler] (2): starting password change request for user [somerandomuser].
[sssd[be[LDAP]]] [sdap_connect_send] (4): Executing START TLS
[sssd[be[LDAP]]] [sdap_install_ldap_callbacks] (8): Trace: sh[0x1b82e60], connected[1], ops[(nil)], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1b82e60], connected[1], ops[0x1b8c1a0], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [sdap_connect_done] (3): START TLS result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1b82e60], connected[1], ops[(nil)], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[LDAP]]] [find_password_expiration_attributes] (9): Found shadow password expiration attributes.
[sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=somerandomuser,ou=People,o=int
[sssd[be[LDAP]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1b82e60], connected[1], ops[0x1b82d60], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [simple_bind_done] (5): Server returned no controls.
[sssd[be[LDAP]]] [simple_bind_done] (3): Bind result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_auth4chpass_done] (7): user [uid=somerandomuser,ou=People,o=int] successfully authenticated.
[sssd[be[LDAP]]] [sdap_auth4chpass_done] (1): Changing shadow password attributes not implemented.
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (3, 4, ) [Internal Error (Success)]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sending result [4][LDAP]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sent result [4][LDAP]
[sssd[be[LDAP]]] [sdap_handle_release] (8): Trace: sh[0x1b82e60], connected[1], ops[(nil)], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[pam]] [sbus_remove_timeout] (8): 0x21ff260
[sssd[pam]] [sbus_dispatch] (6): dbus conn: 22007E0
[sssd[pam]] [sbus_dispatch] (6): Dispatching.
[sssd[pam]] [pam_dp_process_reply] (4): received: [4][LDAP]
[sssd[pam]] [pam_reply] (4): pam_reply get called.
[sssd[pam]] [pam_reply] (4): blen: 21
[sssd[nss]] [client_recv] (5): Client disconnected!
[sssd[pam]] [client_recv] (5): Client disconnected!

========== sssd.conf =========
[sssd]
config_file_version = 2
domains = LDAP
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam

[nss]
filter_groups = root,core
filter_users = root,core
reconnection_retries = 3

[pam]
reconnection_retries = 3

[domain/LDAP]
auth_provider = ldap
cache_credentials = TRUE
chpass_provider = ldap
enumerate = TRUE
id_provider = ldap
ldap_group_search_base = ou=Groups,o=int
ldap_tls_reqcert = never
ldap_uri = ldap://server1.site1 ldap://server2.site2 ldap://server3.site3
ldap_user_search_base = o=int
min_id = 1
timeout = 60
=> A user was complaining about not being able to change their password on one of our sssd client servers in the lab. passwd was failing with "System Error". I was able to reproduce it once after about 10 password changes but wasn't running sssd in debug mode at the time.

It looks like this:
{{{
jschroeder@someserver: ~ $ passwd
Changing password for user jschroeder.
Password:
New UNIX password:
Retype new UNIX password:
passwd: System error
}}}

Working

{{{
[sssd[be[LDAP]]] [sbus_message_handler] (9): Received SBUS method [pamHandler]
[sssd[be[LDAP]]] [be_pam_handler] (4): Got request with the following data
[sssd[be[LDAP]]] [pam_print_data] (4): command: 246
[sssd[be[LDAP]]] [pam_print_data] (4): domain: LDAP
[sssd[be[LDAP]]] [pam_print_data] (4): user: jschroeder
[sssd[be[LDAP]]] [pam_print_data] (4): service: passwd
[sssd[be[LDAP]]] [pam_print_data] (4): tty: pts/34
[sssd[be[LDAP]]] [pam_print_data] (4): ruser:
[sssd[be[LDAP]]] [pam_print_data] (4): rhost:
[sssd[be[LDAP]]] [pam_print_data] (4): authtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): authtok size: 8
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok size: 11
[sssd[be[LDAP]]] [pam_print_data] (4): priv: 0
[sssd[be[LDAP]]] [pam_print_data] (4): pw_uid: 7084
[sssd[be[LDAP]]] [pam_print_data] (4): gr_gid: 100
[sssd[be[LDAP]]] [pam_print_data] (4): cli_pid: 32471
[sssd[be[LDAP]]] [sdap_pam_chpass_handler] (2): starting password change request for user [jschroeder].
[sssd[be[LDAP]]] [sdap_connect_send] (4): Executing START TLS
[sssd[be[LDAP]]] [sdap_install_ldap_callbacks] (8): Trace: sh[0xc8d8c0], connected[1], ops[(nil)], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xc96bd0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_connect_done] (3): START TLS result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[(nil)], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[LDAP]]] [find_password_expiration_attributes] (9): No password expiration attributes found.
[sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=jschroeder,ou=People,o=int
[sssd[be[LDAP]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xc9fdf0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [simple_bind_done] (5): Server returned no controls.
[sssd[be[LDAP]]] [simple_bind_done] (3): Bind result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_auth4chpass_done] (7): user [uid=jschroeder,ou=People,o=int] successfully authenticated.
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (4): Executing extended operation
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (8): ldap_extended_operation sent, msgid = 3
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xcc12e0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xc8d8c0], connected[1], ops[0xcc12e0], fde[0xc96ab0], ldap[0xc96760]
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (5): Server returned no controls.
[sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (3): ldap_extended_operation result: Success(0), (null)
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (0, 0, ) [Success]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sending result [0][LDAP]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sent result [0][LDAP]
[sssd[pam]] [sbus_remove_timeout] (8): [sssd[be[LDAP]]] [sdap_handle_release] (8): 0x13d1660
[sssd[pam]] [sbus_dispatch] (6): dbus conn: 13D27E0
[sssd[pam]] [sbus_dispatch] (6): Dispatching.
[sssd[pam]] [pam_dp_process_reply] (4): received: [0][LDAP]
[sssd[pam]] [pam_reply] (4): pam_reply get called.
[sssd[pam]] [pam_reply] (4): blen: 21
Trace: sh[0xc8d8c0], connected[1], ops[(nil)], fde[0xc96ab0], ldap[0xc96760]
[sssd[pam]] [client_recv] (5): Client disconnected!
[sssd[nss]] [client_recv] (5): Client disconnected!
}}}

Not working

{{{
[sssd[be[LDAP]]] [sbus_message_handler] (9): Received SBUS method [pamHandler]
[sssd[be[LDAP]]] [be_pam_handler] (4): Got request with the following data
[sssd[be[LDAP]]] [pam_print_data] (4): command: 246
[sssd[be[LDAP]]] [pam_print_data] (4): domain: LDAP
[sssd[be[LDAP]]] [pam_print_data] (4): user: somerandomuser
[sssd[be[LDAP]]] [pam_print_data] (4): service: passwd
[sssd[be[LDAP]]] [pam_print_data] (4): tty: pts/32
[sssd[be[LDAP]]] [pam_print_data] (4): ruser:
[sssd[be[LDAP]]] [pam_print_data] (4): rhost:
[sssd[be[LDAP]]] [pam_print_data] (4): authtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): authtok size: 10
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok type: 1
[sssd[be[LDAP]]] [pam_print_data] (4): newauthtok size: 12
[sssd[be[LDAP]]] [pam_print_data] (4): priv: 0
[sssd[be[LDAP]]] [pam_print_data] (4): pw_uid: 7111
[sssd[be[LDAP]]] [pam_print_data] (4): gr_gid: 100
[sssd[be[LDAP]]] [pam_print_data] (4): cli_pid: 10102
[sssd[be[LDAP]]] [sdap_pam_chpass_handler] (2): starting password change request for user [somerandomuser].
[sssd[be[LDAP]]] [sdap_connect_send] (4): Executing START TLS
[sssd[be[LDAP]]] [sdap_install_ldap_callbacks] (8): Trace: sh[0x1b82e60], connected[1], ops[(nil)], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1b82e60], connected[1], ops[0x1b8c1a0], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [sdap_connect_done] (3): START TLS result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1b82e60], connected[1], ops[(nil)], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[LDAP]]] [find_password_expiration_attributes] (9): Found shadow password expiration attributes.
[sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=somerandomuser,ou=People,o=int
[sssd[be[LDAP]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x1b82e60], connected[1], ops[0x1b82d60], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[be[LDAP]]] [simple_bind_done] (5): Server returned no controls.
[sssd[be[LDAP]]] [simple_bind_done] (3): Bind result: Success(0), (null)
[sssd[be[LDAP]]] [sdap_auth4chpass_done] (7): user [uid=somerandomuser,ou=People,o=int] successfully authenticated.
[sssd[be[LDAP]]] [sdap_auth4chpass_done] (1): Changing shadow password attributes not implemented.
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (3, 4, ) [Internal Error (Success)]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sending result [4][LDAP]
[sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sent result [4][LDAP]
[sssd[be[LDAP]]] [sdap_handle_release] (8): Trace: sh[0x1b82e60], connected[1], ops[(nil)], fde[0x1b8c080], ldap[0x1b82e90]
[sssd[pam]] [sbus_remove_timeout] (8): 0x21ff260
[sssd[pam]] [sbus_dispatch] (6): dbus conn: 22007E0
[sssd[pam]] [sbus_dispatch] (6): Dispatching.
[sssd[pam]] [pam_dp_process_reply] (4): received: [4][LDAP]
[sssd[pam]] [pam_reply] (4): pam_reply get called.
[sssd[pam]] [pam_reply] (4): blen: 21
[sssd[nss]] [client_recv] (5): Client disconnected!
[sssd[pam]] [client_recv] (5): Client disconnected!
}}}

========== sssd.conf =========
{{{
[sssd]
config_file_version = 2
domains = LDAP
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam

[nss]
filter_groups = root,core
filter_users = root,core
reconnection_retries = 3

[pam]
reconnection_retries = 3

[domain/LDAP]
auth_provider = ldap
cache_credentials = TRUE
chpass_provider = ldap
enumerate = TRUE
id_provider = ldap
ldap_group_search_base = ou=Groups,o=int
ldap_tls_reqcert = never
ldap_uri = ldap://server1.site1 ldap://server2.site2 ldap://server3.site3
ldap_user_search_base = o=int
min_id = 1
timeout = 60
}}}
owner: somebody => simo

Please triage and pick an appropriate milestone.

owner: simo => sbose

Actually the problem is that when passwd checks for your current password, it always passes even if it is not correct. So you probably had typo in one of the 10 attempts. If you type your current password correct everything goes as it should.

villeys: I think you're incorrect. It was tracked down to the user that consistently fails had shadow* attributes.

Sumit submitted a patch to the dev list with the subject "Ignore shadow attributes" this morning which should fix the problem. We verified the problem by removing the shadow* attributes from the user and the problem was resolved.

Fields changed

tests: 0 => 1

Then another bug is that checking your current password always succeeds and the result is System error message:

[user12@host ~]$ passwd
Changing password for user user12.
Password: 
New UNIX password: 
Retype new UNIX password: 
passwd: System error
[user12@host ~]$

I mean you get "System error" when you type your current password wrong.

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.0 RC

Fixed in be1697216fc62578c00606458b0ff390c575ef67

fixedin: => 1.0.0rc
resolution: => fixed
status: new => closed

Fields changed

proposed: =>
tests: 1 => 0
testsupdated: 0 => 1

Fields changed

rhbz: => 0

Metadata Update from @sejeff:
- Issue assigned to sbose
- Issue set to the milestone: SSSD 1.0 RC

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1321

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Normal
defect
LDAP Provider
0.7.1
1
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.