SSSD / sssd

#938 LDAP backend fails on Debian Squeeze
Closed: Invalid Opened by dpiddock.

Closed: Invalid
Reopen Issue

I'm having troubles getting 1.5.11 to work under Debian Squeeze. 1.5.8 works. Nothing else has changed on the systems. Confusingly 1.5.11 works under Fedora 14 with an identical sssd.conf. These are custom builds including the fix for #922

I'm not sure what exactly to include to help debug this as I'm slightly stumped, it just bails out with "something bad happened". So I'm going to include lots. Attached will be:
- the build log for 1.5.11 under a Debian sbuild environment
- list of requirements and their current versions
- sssd logs (debug 9) plus corresponding slapd syslog output attempting a login for:
- 1.5.8 under Debian Squeeze [successful]
- 1.5.11 under Fedora 14 [successful]
- 1.5.11 under Debian Squeeze [fail]

Apart from Debian and Fedora specific patches the upstream versions of openldap on both systems are identical. Fedora builds against NSS and Debian against gnutls. The slapd server is 2.4.23 under Squeeze.

attachment
sssd-logs.tar.bz

I have attached a patch that should hopefully give us more information when we see the "Something bad happened" message. Please apply it and check the logs.

Hi. I've just given that patch a go. Doesn't appear to help :(

(Thu Jul 28 13:37:04 2011) [sssd[br[default]]] [sdap_process_result] (4): ldap_result gave -1, something bad happened!
(Thu Jul 28 13:37:04 2011) [sssd[br[default]]] [sdap_process_result] (4): ldap_result error: [unknown error]

The debug line could also do with a \n at the end.

On a hunch I decided to take SSL out of the loop. Login now happens successfully. However setting "ldap_tls_reqcert = never" did not help. There appears to be a disagreement between sssd 1.5.11 and Debian's OpenSSL+gnutls, or something else in the crypto stack on Squeeze.

I'm closing this ticket as WORKSFORME for now. If it's determined that there is something we can do to get SSSD to play more nicely with Debian's openldap libraries, please reopen this ticket.

resolution: => worksforme
status: new => closed

I've done a bit more poking and prodding. Disabling HAVE_LDAP_INIT_FD macro allows 1.5.12 and 1.6.0 to run successfully on Debian Squeeze. No surprise really, ldap_init_fd was part of the main code changes since 1.5.8. Not reopening as I'm not sure if this enlightens enough to actually fix anything.

Recent testing was also returning a "TLS negotiation failure" on the server side rather than the connection terminating.

Fields changed

rhbz: => 0

Fields changed

milestone: NEEDS_TRIAGE => void

Metadata Update from @dpiddock:
- Issue set to the milestone: void

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1980

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
Normal
defect
LDAP Provider
1.5.11
0
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.