On su, 22 heinä 2018, Николай Савельев wrote:
22.07.2018, 14:16, "Alexander Bokovoy" <[email protected]>:
Again, show sssd logs. I suspect it is something with communicating to
your AD DCs because SSSD doesn't use anything else to authenticate.
Here you are
So, SSSD is not able to communicate with AD DCs and puts the domain
offline. You can see in /var/log/sssd/krb5_child.log and ldap_child.log
for details on why thing fail.
(Sun Jul 22 15:54:19 2018) [sssd[be[fs.lan]]] [ipa_srv_ad_acct_lookup_done]
(0x0080): Sudomain lookup failed, will try to reset sudomain..
(Sun Jul 22 15:54:19 2018) [sssd[be[fs.lan]]]
[ipa_server_trusted_dom_setup_send] (0x1000): Trust direction of subdom
start-line.local from forest start-line.local is: one-way inbound: local
+domain trusts the remote domain
(Sun Jul 22 15:54:19 2018) [sssd[be[fs.lan]]]
[ipa_server_trusted_dom_setup_1way] (0x0400): Will re-fetch keytab for
start-line.local
(Sun Jul 22 15:54:19 2018) [sssd[be[fs.lan]]] [ipa_getkeytab_send] (0x0400):
Retrieving keytab for [email protected] from dc.fs.lan into
/var/lib/sss/keytabs/start-line.local.keytab5Q7g1i
+using ccache /var/lib/sss/db/ccache_FS.LAN
(Sun Jul 22 15:54:19 2018) [sssd[be[fs.lan]]] [child_handler_setup] (0x2000):
Setting up signal handler up for pid [9290]
(Sun Jul 22 15:54:19 2018) [sssd[be[fs.lan]]] [child_handler_setup] (0x2000):
Signal handler set up for pid [9290]
(Sun Jul 22 15:54:19 2018) [sssd[be[fs.lan]]] [sdap_process_result] (0x2000):
Trace: sh[0x55acec715d90], connected[1], ops[(nil)], ldap[0x55acec7069b0]
(Sun Jul 22 15:54:19 2018) [sssd[be[fs.lan]]] [sdap_process_result] (0x2000):
Trace: end of ldap_result list
Keytab successfully retrieved and stored in:
/var/lib/sss/keytabs/start-line.local.keytab5Q7g1i
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [child_sig_handler] (0x1000):
Waiting for child [9290].
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [child_sig_handler] (0x0100):
child [9290] finished successfully.
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [ipa_getkeytab_recv] (0x2000):
ipa-getkeytab status 0
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [ipa_server_trust_1way_kt_done]
(0x0400): Keytab successfully retrieved to
/var/lib/sss/keytabs/start-line.local.keytab5Q7g1i
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [ipa_check_keytab] (0x4000):
keytab /var/lib/sss/keytabs/start-line.local.keytab5Q7g1i already exists
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [ipa_server_trust_1way_kt_done]
(0x2000): Keytab renamed to /var/lib/sss/keytabs/start-line.local.keytab
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [ipa_server_trust_1way_kt_done]
(0x0400): Keytab /var/lib/sss/keytabs/start-line.local.keytab5Q7g1i contains
the expected principals
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [ipa_server_trust_1way_kt_done]
(0x0400): Established trust context for start-line.local
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [unique_filename_destructor]
(0x2000): Unlinking [/var/lib/sss/keytabs/start-line.local.keytab5Q7g1i]
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [unlink_dbg] (0x2000): File
already removed: [/var/lib/sss/keytabs/start-line.local.keytab5Q7g1i]
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [ipa_srv_ad_acct_retried]
(0x0400): Sudomain re-set, will retry lookup
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [be_fo_reset_svc] (0x1000):
Resetting all servers in service start-line.local
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [be_fo_reset_svc] (0x0080):
Cannot retrieve service [start-line.local]
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [ipa_srv_ad_acct_lookup_step]
(0x0400): Looking up AD account
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [sss_domain_get_state] (0x1000):
Domain fs.lan is Active
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [sss_domain_get_state] (0x1000):
Domain start-line.local is Inactive
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [sss_domain_get_state] (0x1000):
Domain start-line.local is Inactive
(Sun Jul 22 15:54:20 2018) [sssd[be[fs.lan]]] [be_mark_dom_offline] (0x1000):
Marking subdomain start-line.local offline
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]/message/UCZ4R5UIFQJNAKFAL4SCW7642HC35E77/
