[Freeipa-users] sssd/pam login issues after upgrade to 2.2.1 on Fedora 17

[Anthony Messina]

On Monday, November 12, 2012 09:17:17 AM Anthony Messina wrote:
> > > I also find that when I do a manual ldapsearch for the non-upgraded
> > > clients as >
> > >
> > > follows:
> > > 
> > >
> > > ldapsearch -x -D "cn=directory manager" -W -b
> > > cn=accounts,dc=messinet,dc=com  "(&(objectClass=ipaHost)(fqdn=*))" dn
> > >
> > > 
> > >
> > > the non-upgraded clients DO NOT appear in the list, but if I do the 
> 
> following:
> > > 
> > >
> > > ldapsearch -x -D "cn=directory manager" -W -b
> > > cn=accounts,dc=messinet,dc=com  "(&(objectClass=ipaHost))" dn
> > >
> > > 
> > >
> > > the non-upgraded clients DO appear in the list.  Somehow the addition of
> > > the  fqdn=* in the filter "(&(objectClass=ipaHost)(fqdn=*))" prevents
> > > them from being displayed.
> > >
> > > 
> > >
> > > There were no errors on any of the servers or clients during the
> > > upgrade.
> > >
> > > 
> > >
> > > Your help is appreciated.  I've tried to get this corrected all day
> > > without  success.
> > >
> > > 
> > >
> > > Thanks in advance.  -A
> >
> > 
> >
> > Hi,
> >
> > 
> >
> > the SSSD depends on the fqdn attribute being present for the access
> > control mechanism. Also, the SSSD searches the directory anonymously, so
> > in order to get the same results, you should simply search the directory
> > with anonymous bind.
> > Can you check on the server how the host entries look like? 
> >
> > 
> >
> > For example:
> > ipa host-show ds.messinet.com --all --raw
> >
> > 
> >
> > Is the FQDN attribute present in the directory at all?
> 
> Yes it is present.  The entry seems to appear similar to other
> entries.  I'm  wondering if for some reason it wasn't indexed (I don't know
> much about indexing), but only the hosts that are re-enrolled after the
> update are displayed with the above search.  I'm thinking this may be
> related to
> http://git.fedorahosted.org/cgit/freeipa.git/commit/?h=ipa-2-2&id=ce11a7c0e
> 22ee8f70e14c43419f20be70176fe8c
> 
> Is there a way to re-index the fqdn attribute?

While this may be a red herring, I also do not find in my ipaupgrade.log any 
attempt to re-index the fqdn attribute.  These are the only entries for which 
tasks are created.

2012-11-11T13:25:39Z INFO Creating task to index attribute: memberuid
2012-11-11T13:25:45Z INFO Creating task to index attribute: memberOf
2012-11-11T13:25:51Z INFO Creating task to index attribute: memberHost
2012-11-11T13:25:57Z INFO Creating task to index attribute: memberUser
2012-11-11T13:26:03Z INFO Creating task to index attribute: ntUniqueId
2012-11-11T13:26:09Z INFO Creating task to index attribute: ntUserDomainId


-- 
Anthony - http://messinet.com - http://messinet.com/~amessina/gallery
8F89 5E72 8DF0 BCF0 10BE 9967 92DC 35DC B001 4A4E
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20121112/d86ea00a/attachment.sig>