SSSD / sssd

#4035 SSSD and Samba in RHEL/CentOS 7.6
Closed: duplicate by sbose. Opened by carwyn.

Closed: duplicate
Reopen Issue

I think I've found an issue with the combination of sssd and samba on RHEL/CentOS
7.6. I have removed sssd-libwbclient and only use the Samba libwbclient.

/etc/samba.smb.conf

[global]
workgroup = AD
security = ads
realm = ad.mydomain.com
kerberos method = system keytab
idmap config AD : backend = sss
idmap config AD : range = 10000-1999999999
idmap config * : backend = tdb
idmap config * : range = 9000-9999

/etc/sssd/sssd.conf seems to need to contain (along with whatever realmd generates):

ldap_id_mapping = True # use sssd mastered uids/gids
ad_maximum_machine_account_password_age = 0 # stop sssd messing with host password

We also have:

ignore_group_members = True # for speed
ldap_idmap_range_size = 2000000 # we have lots of users

Then join making sure to use net join not adcli

$ realm join --membership-software=samba -U mydomain_admin ad.mydomain.com

On Fedora 30 the above works perfectly with all wbinfo commands working as expected and
samba shares behave.

Fedora 30:

$ rpm -q sssd samba
sssd-2.2.0-1.fc30.x86_64
samba-4.10.4-1.fc30.x86_64

BUT (big but)

On CentOS 7.6 with exactly the same configuration .. it only sometimes works.

$ rpm -q sssd samba
sssd-1.16.2-13.el7_6.8.x86_64
samba-4.8.3-4.el7.x86_64

I end up with behaviour along these lines:

Config and domain join as above, then try some lookups.

$ wbinfo -n user086
S-1-5-21-*-*-*-39092 SID_USER (1)
$ wbinfo -S S-1-5-21-*-*-*-39092
failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND
Could not convert sid S-1-5-21-*-*-*-39092 to uid
$ systemctl stop smb
$ systemctl restart winbind
$ wbinfo -S S-1-5-21-*-*-*-39092
failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND
Could not convert sid S-1-5-21-*-*-*-39092 to uid
$ systemctl restart sssd
$ wbinfo -S S-1-5-21-*-*-*-39092
failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND
Could not convert sid S-1-5-21-*-*-*-39092 to uid
$ systemctl restart sssd
$ wbinfo -S S-1-5-21-*-*-*-39092
failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND
Could not convert sid S-1-5-21-*-*-*-39092 to uid
# Wait around 30 seconds ... ****** THIS BIT ******
$ wbinfo -S S-1-5-21-*-*-*-39092
42239092

Another run after scrubbing all config and tdb files, then after rejoin:

$ wbinfo -n user21b
S-1-5-21-*-*-*-179094 SID_USER (1)
$ wbinfo -n user20b
S-1-5-21-*-*-*-153534 SID_USER (1)
$ wbinfo -s S-1-5-21-*-*-*-179094
AD\user21b 1
$ wbinfo -s S-1-5-21-*-*-*-153534
AD\user20b 1
$ wbinfo -S S-1-5-21-*-*-*-153534
failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND
Could not convert sid S-1-5-21-*-*-*-153534 to uid
$ wbinfo -S S-1-5-21-*-*-*-179094
failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND
Could not convert sid S-1-5-21-*-*-*-179094 to uid
$ systemctl restart winbind
$ systemctl restart sssd
# wbinfo -n user21b
S-1-5-21-*-*-*-179094 SID_USER (1)
# wbinfo -n user20b
S-1-5-21-*-*-*-153534 SID_USER (1)
# wbinfo -s S-1-5-21-*-*-*-179094
AD\user21b 1
# wbinfo -s S-1-5-21-*-*-*-153534
AD\user20b 
# wbinfo -S S-1-5-21-*-*-*-179094
42379094
# wbinfo -S S-1-5-21-*-*-*-153534
42353534

I'm still trying to nail down what's going on here, but it feels very timing
orientated. Left for a few hours a working config suddenly doesn't seem to want to
resolve the sss based id resolution. The wbinfo -S queries are the ones that stop working
(sid to uid), all the -s, -i, -n queries still work and -t and -D AD still say sensible
things.

Importantly I can't get any of this to break on Fedora 30 though with the sssd and
samba versions noted above.

Not sure if this is on the samba side or sssd-winbind-idmap .. or if I'm simply losing
my mind here :)

Are there any known bugs or re-workings to the sss or winbind bits between sssd 1.16 and
2.2 or samba 4.8 and 4.10 that would account for this?

Hi,

thanks for the report, please see my reply on the sssd-users list as well. This is a duplicate of https://pagure.io/SSSD/sssd/issue/4005.

bye,
Sumit

Metadata Update from @sbose:
- Custom field design_review adjusted to on
- Custom field mark adjusted to on
- Custom field patch adjusted to on
- Custom field review adjusted to on
- Custom field sensitive adjusted to on
- Custom field testsupdated adjusted to on
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/5005

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
High
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.