SSSD / sssd

#4019 sssd is searching for incorrect user (postfix) in ldap instead of the actual user who is trying to sudo
Closed: Invalid by rbairi. Opened by rbairi.

Closed: Invalid
Reopen Issue

Operating system: Linux 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u2 (2017-03-07) x86_64 GNU/Linux

When the user "rbairi" tries to do "sudo su -", the sssd log shows that it is doing an ldap search for user "postfix".

Using FreeIPA to authenticate and sudo.

sssd log

(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [be_get_account_info] (0x0100): Got request for [4099][1][name=postfix]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [be_req_set_domain] (0x0400): Changing request domain from [REDACTED.net] to [REDACTED.net]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [cn=accounts,dc=REDACTED,dc=net]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=postfix)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))][cn=accounts,dc=REDACTED,dc=net].
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [homeDirectory]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPrincipalName]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaNTSecurityIdentifier]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [entryUSN]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaSshPubKey]
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sysdb_search_user_by_name] (0x0400): No such entry
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory)
(Tue Jun 4 12:45:16 2019) [sssd[be[REDACTED.net]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success

sssd.conf

[domain/REDACTED.net]

cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = REDACTED.net
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = testhost.REDACTED.net
chpass_provider = ipa
ipa_server = srv, freeipa.REDACTED.net
ldap_tls_cacert = /etc/ipa/ca.crt
debug_level = 7

sudo_provider = ipa

[sssd]
services = nss, sudo, pam, ssh
config_file_version = 2

domains = REDACTED.net
[nss]
homedir_substring = /home

[pam]

[sudo]

[autofs]

[ssh]

[pac]

[ifp]

/etc/pam.d/password-auth

auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so

account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so

password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok

password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session optional pam_oddjob_mkhomedir.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so

This is probably completely unrelated. Can you show your nsswitch.conf and the sudo responder logs?

see also https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html

You're right, tried on a new host, it is looking for the correct user now, but failing for a different reason. Will research that...
Thanks a lot!

Metadata Update from @rbairi:
- Issue close_status updated to: Invalid
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4990

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
High
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.