On 10/17/2012 10:46 AM, Simo Sorce wrote:
On Wed, 2012-10-17 at 09:53 -0600, Rich Megginson wrote:
On 10/17/2012 07:26 AM, Macklin, Jason wrote:

    Rule name: test4
    Enabled: TRUE
    Command category: all
    Users: asteinfeld
    Hosts: dbduwdu062.dbr.roche.com
    Host Groups: tempsudo

Client dbduwdu062 is matched in the rule by both the hosts and groups entry.

/etc/nsswitch.conf has:

        Netgroups: files sss

Getent netgroup tempsudo returns:

        [jmacklin@dbduwdu062 Desktop]$ getent netgroup tempsudo
        tempsudo              (dbduwdu063.dbr.roche.com, -, dbr.roche.com) 
(dbduwdu062.dbr.roche.com, -, dbr.roche.com)

To the previous ldapsearch request:

        [jmacklin@dbduwdu062 Desktop]$ ldapsearch -Y GSSAPI -H 
ldap://dbduvdu145.dbr.roche.com "ou=SUDOers,dc=dbr,dc=roche,dc=com"
        SASL/GSSAPI authentication started
        ldap_sasl_interactive_bind_s: Server is unwilling to perform (53)
        additional info: Entry permanently locked.

I am still scratching my head on this one...
This means you cannot search using your kerberos ticket because the
corresponding entry is locked.  Try using directory manager:

ldapsearch -x -D "cn=directory manager" -W -H
ldap://dbduvdu145.dbr.roche.com "ou=SUDOers,dc=dbr,dc=roche,dc=com"

This sounds very wrong.

If the user had a kerberos ticket in the first place it meant it
successfully authenticated.

If no krb ticket was available GSSAPI would have not started at all.

This look like some odd error in directory server failing to recognize
valid users ?
Not sure what's going on.  Looking at the code in ipa_lockout.c:
lockout_duration = slapi_entry_attr_get_uint(policy_entry, "krbPwdLockoutDuration");
    if (lockout_duration == 0) {
        errstr = "Entry permanently locked.\n";
        goto done;

This means either krbPwdLockoutDuration does not exist at all, or does exist and has a value of 0.

Can you do an ldapsearch of your entry like this:

ldapsearch -xLLL -D "cn=directory manager" -W uid=youruserid \* krbPwdLockoutDuration


Freeipa-users mailing list

Reply via email to