<div dir="ltr">HI<div><br></div><div>i have enabled debug</div><div><br></div><div>here is my sssd.conf</div><div><br></div><div><div>[root@kwtpocpbis01 ~]# cat /etc/sssd/sssd.conf</div><div>[domain/solaris.local]</div><div><br></div><div>cache_credentials = True</div><div>krb5_store_password_if_offline = True</div><div>ipa_domain = solaris.local</div><div>id_provider = ipa</div><div>auth_provider = ipa</div><div>access_provider = ipa</div><div>ipa_hostname = kwtpocpbis01.solaris.local</div><div>chpass_provider = ipa</div><div>ipa_server = kwtpocpbis01.solaris.local</div><div>ipa_server_mode = True</div><div>ldap_tls_cacert = /etc/ipa/ca.crt</div><div>[sssd]</div><div>services = nss, sudo, pam, ssh</div><div>config_file_version = 2</div><div><br></div><div>domains = solaris.local</div><div>debug_level = 6</div><div>[nss]</div><div>homedir_substring = /home</div><div>debug_level = 6</div><div><br></div><div>[pam]</div><div><br></div><div>[sudo]</div><div><br></div><div>[autofs]</div><div><br></div><div>[ssh]</div><div><br></div><div>[pac]</div><div><br></div><div>[ifp]</div></div><div><br></div><div><br></div><div>LOGS:</div><div><br></div><div>sssd.log:</div><div><br></div><div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging solaris.local</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging nss</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging sudo</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging pam</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging ssh</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging pac</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service nss replied to ping</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service sudo replied to ping</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service pam replied to ping</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service ssh replied to ping</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service solaris.local replied to ping</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service pac replied to ping</div></div><div><br></div><div><br></div><div>error_log:</div><div><br></div><div><div>[root@kwtpocpbis01 ~]# tail -f /var/log/httpd/error_log</div><div>[Tue Mar 17 11:26:25.458878 2015] [:error] [pid 15175] ipa: INFO: *** PROCESS START ***</div><div>[Tue Mar 17 11:26:25.603536 2015] [:error] [pid 15176] ipa: DEBUG: session_auth_duration: 0:20:00</div><div>[Tue Mar 17 11:26:25.609112 2015] [:error] [pid 15176] ipa: DEBUG: session_auth_duration: 0:20:00</div><div>[Tue Mar 17 11:26:25.655477 2015] [:error] [pid 15176] ipa: DEBUG: Mounting ipaserver.rpcserver.login_kerberos() at '/session/login_kerberos'</div><div>[Tue Mar 17 11:26:25.655597 2015] [:error] [pid 15176] ipa: DEBUG: session_auth_duration: 0:20:00</div><div>[Tue Mar 17 11:26:25.681652 2015] [:error] [pid 15176] ipa: DEBUG: Mounting ipaserver.rpcserver.login_password() at '/session/login_password'</div><div>[Tue Mar 17 11:26:25.681849 2015] [:error] [pid 15176] ipa: DEBUG: session_auth_duration: 0:20:00</div><div>[Tue Mar 17 11:26:25.754351 2015] [:error] [pid 15176] ipa: INFO: *** PROCESS START ***</div><div>p11-kit: ipa.p11-kit: x-public-key-info: invalid or unsupported attribute</div><div>[Tue Mar 17 11:26:28.847563 2015] [:warn] [pid 15377] NSSProtocol: Unknown protocol 'tlsv1.2' not supported</div></div><div><br></div><div>secure:</div><div><div>[root@kwtpocpbis01 log]# tail -f secure</div><div>Mar 17 12:35:41 kwtpocpbis01 sshd[15714]: subsystem request for sftp by user root</div><div>Mar 17 12:35:44 kwtpocpbis01 sshd[15736]: Accepted password for root from 10.18.2.130 port 64141 ssh2</div><div>Mar 17 12:35:44 kwtpocpbis01 sshd[15736]: pam_unix(sshd:session): session opened for user root by (uid=0)</div><div>Mar 17 12:35:44 kwtpocpbis01 sshd[15736]: subsystem request for sftp by user root</div><div>Mar 17 12:39:12 kwtpocpbis01 sshd[14507]: pam_unix(sshd:session): session closed for user root</div><div>Mar 17 12:40:57 kwtpocpbis01 sshd[15816]: Invalid user <a href="mailto:bobby@infra.com">bobby@infra.com</a> from 10.18.2.130</div><div>Mar 17 12:40:57 kwtpocpbis01 sshd[15816]: input_userauth_request: invalid user <a href="mailto:bobby@infra.com">bobby@infra.com</a> [preauth]</div><div>Mar 17 12:41:02 kwtpocpbis01 sshd[15816]: pam_unix(sshd:auth): check pass; user unknown</div><div>Mar 17 12:41:02 kwtpocpbis01 sshd[15816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.18.2.130</div><div>Mar 17 12:41:04 kwtpocpbis01 sshd[15816]: Failed password for invalid user <a href="mailto:bobby@infra.com">bobby@infra.com</a> from 10.18.2.130 port 64470 ssh2</div><div><br></div><div>Mar 17 12:44:56 kwtpocpbis01 sshd[15840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.18.2.130 user=<a href="mailto:ben@infra.com">ben@infra.com</a></div><div>Mar 17 12:44:57 kwtpocpbis01 sshd[15840]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.18.2.130 user=<a href="mailto:ben@infra.com">ben@infra.com</a></div><div>Mar 17 12:44:57 kwtpocpbis01 sshd[15840]: Accepted password for <a href="mailto:ben@infra.com">ben@infra.com</a> from 10.18.2.130 port 64782 ssh2</div><div>Mar 17 12:44:59 kwtpocpbis01 sshd[15840]: pam_unix(sshd:session): session opened for user <a href="mailto:ben@infra.com">ben@infra.com</a> by (uid=0)</div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 17, 2015 at 12:09 PM, Jakub Hrozek <span dir="ltr"><<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Tue, Mar 17, 2015 at 11:37:24AM +0300, Ben .T.George wrote:<br> > HI List<br> ><br> > i was following this link :<br> > <a href="http://www.freeipa.org/page/Active_Directory_trust_setup#Assumptions" target="_blank">http://www.freeipa.org/page/Active_Directory_trust_setup#Assumptions</a><br> > to setup IPA server<br> ><br> > my IPA version is 4.1.2<br> ><br> > every setps in this tutorials was passed without any error<br> ><br> </span>> even "*Allow access for users from AD domain to protected resources*"<br> <span class="">> went successfully<br> > my current issue is only one user called ben can able to login to ipa<br> > server.please check below:<br> ><br> > [root@kwtpocpbis01 ~]# getent passwd <a href="mailto:ben@infra.com">ben@infra.com</a><br> > ben@infra.com:*:531001104:531001104:ben:/home/<a href="http://infra.com/ben" target="_blank">infra.com/ben</a>:<br> > [root@kwtpocpbis01 ~]# getent passwd <a href="mailto:bobby@infra.com">bobby@infra.com</a><br> > [root@kwtpocpbis01 ~]# getent passwd <a href="mailto:administrator@infra.com">administrator@infra.com</a><br> > [root@kwtpocpbis01 ~]#<br> ><br> > the users ben & bobby are on same group (Domain users). but bobby cannot<br> > able to login to IPA and not getting any information while querying<br> > please help me to fix this issue. i don't know where i need to troubleshoot<br> > this issue.<br> <br> </span>Can you increase debug_level in both [nss] and [domain] sections on the<br> server and paste the logs here?<br> <span class="HOEnZb"><font color="#888888"><br> --<br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br> </font></span></blockquote></div><br></div>