<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 08/10/2016 05:19 PM, Guy Knights wrote:<br>
<blockquote
cite="mid:CAFtmDk90fpAf5i=Q+u_WKGV76UvkDFUPMPBZvLAohKauBtQmkw@mail.gmail.com"
type="cite">
<div dir="ltr">Ok, I increased the debug level as you recommended
and it's given me a lot of useful info. Before I go any further
trying to troubleshoot that mass of info on this mailing list
though, I would like to double check something I came across. In
the debug output I noticed this line:
<div>
<div>
<p class=""><span class="">"No ccache file for user [<a
moz-do-not-send="true" href="mailto:bobt@ad.bbg.net">bobt@ad.bbg.net</a>]
found."</span></p>
</div>
</div>
</div>
</blockquote>
I would not dwell much on this error message, I see the same error
from the krb5_auth_prepare_ccache_name function when I successfully
logged in as an AD user on my IPA client(I suspect the ccache gets
created shortly after). Higher debug logs means there will be a lot
of log messages that look like errors but may not be.<br>
<blockquote
cite="mid:CAFtmDk90fpAf5i=Q+u_WKGV76UvkDFUPMPBZvLAohKauBtQmkw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<p class="">I then searched this error and found this thread
in which the OP seems to have basically the same setup as
me:</p>
<p class=""><a moz-do-not-send="true"
href="https://lists.fedorahosted.org/pipermail/sssd-users/2013-January/000379.html">https://lists.fedorahosted.org/pipermail/sssd-users/2013-January/000379.html</a><br>
</p>
<p class="">I started playing with kinit on the ubuntu
machine that I'm trying to log into, and got this error:</p>
<p class="">"kinit: Cannot find KDC for realm "<a
moz-do-not-send="true" href="http://AD.BBG.NET">AD.BBG.NET</a>"
while getting initial credentials"<br>
</p>
<p class="">After reading through some of the replies on the
above thread, I saw a post that basically says that while
the initial user info lookup is via FreeIPA, to actually
authenticate a user the ipa client machine must connect
directly to the AD controller. If this is true, it
basically means the setup I was planning to use (FreeIPA
in the cloud replicating/proxying local AD user accounts)
is not going to work as I'd hoped. Could you confirm if
this behaviour is in fact correct?</p>
</div>
</div>
</div>
</blockquote>
Yes, the IPA client at some points needs to communicate directly
with AD for kerberos communication - you should see this in
/var/log/sssd/krb5_child.log<br>
<br>
This is explained better than I could here:<br>
<blockquote>
<h2>The anatomy of a trusted identity lookup</h2>
</blockquote>
<blockquote><a
href="https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-ipa-ad-trust-deployments/">https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-ipa-ad-trust-deployments/</a><br>
</blockquote>
<br>
Kind regards,<br>
Justin Stephenson<br>
<blockquote
cite="mid:CAFtmDk90fpAf5i=Q+u_WKGV76UvkDFUPMPBZvLAohKauBtQmkw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>Thanks,<br>
Guy</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On 9 August 2016 at 18:47, Justin
Stephenson <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:jstephen@redhat.com" target="_blank">jstephen@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<p>Hello,</p>
<p>You may need to increase the debug level to 9 and look
in the sssd_<ipadomain>.log for failures after the
failed login attempt - i would look in between log
messages 'Got request for bobt...' and 'Backend
returned' messages<br>
</p>
<p> <a moz-do-not-send="true"
href="https://fedorahosted.org/sssd/wiki/Troubleshooting"
target="_blank">https://fedorahosted.org/sssd/<wbr>wiki/Troubleshooting</a></p>
<p>You can also send the debug logs here for review.</p>
<p>Make sure logins and lookups are working on the IPA
server first before troubleshooting the IPA client.<br>
</p>
<p>Kind regards,</p>
<p>Justin Stephenson<br>
</p>
<div>
<div class="h5">
<div>On 08/09/2016 07:32 PM, Guy Knights wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">I've set up a freeipa server on a
centos 7 machine and have successfully configured
a 2-way trust between it and our active directory
domain controller. I've also installed ipa-client
on an ubuntu 14.04 machine and have run
ipa-client-install, which has apparently
successfully joined the FreeIPA domain.<br>
<div><br>
</div>
<div>So far, I can successfully do the following:</div>
<div><br>
</div>
<div>1. Log into the FreeIPA machine with an AD
user account.</div>
<div>2. Log into the Ubuntu machine with a FreeIPA
account.</div>
<div>3. Run 'getent passwd <freeipa
username>' on the Ubuntu machine and have it
return the associated FreeIPA user account
details (eg. "jackt:*:1131000005:<wbr>1131000005:Jack
Test:/home/<a moz-do-not-send="true"
href="http://ipa.bbg.net/jackt:/bin/bash"
target="_blank">ipa.bbg.net/jackt:/<wbr>bin/bash</a>")</div>
<div>4. Run 'getent passwd <ad username>' on
the Ubuntu machine and have it return the
associated AD user account details (eg. "<a
moz-do-not-send="true"
href="mailto:bobt@ad.bbg.net:*:1946801107:1946801107::/home/"
target="_blank">bobt@ad.bbg.net:*:1946801107:<wbr>1946801107::/home/</a><a
moz-do-not-send="true"
href="http://ad.bbg.net/bobt:/bin/bash"
target="_blank">ad.bbg.net/<wbr>bobt:/bin/bash</a>")</div>
<div><br>
</div>
<div>What I can't do is log into the Ubuntu
machine with the AD user. I'm using the
following SSH command from the command line on
my mac:</div>
<div><br>
</div>
<div>ssh -o User=<a moz-do-not-send="true"
href="mailto:bobt@ad.bbg.net" target="_blank">bobt@ad.bbg.net</a>
<a moz-do-not-send="true"
href="http://vm1.bbg.com" target="_blank">vm1.bbg.com</a></div>
<div><br>
</div>
<div>It asks me for the password, I enter it and
it says permissions denied, please try again. I
set the debug level in SSSD on the ubuntu client
to 5 and this is what shows up in the log during
the login attempt:</div>
<div><br>
</div>
(Tue Aug 9 16:25:56 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[be_get_account_info] (0x0100): Got request for
[4097][1][name=bobt]<br>
(Tue Aug 9 16:25:56 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[acctinfo_callback] (0x0100): Request processed.
Returned 3,95,Account info lookup failed<br>
(Tue Aug 9 16:25:57 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[acctinfo_callback] (0x0100): Request processed.
Returned 0,0,Success<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[be_get_account_info] (0x0100): Got request for
[3][1][name=bobt]<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[acctinfo_callback] (0x0100): Request processed.
Returned 3,95,Account info lookup failed<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[be_pam_handler] (0x0100): Got request with the
following data<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): command:
PAM_AUTHENTICATE<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): domain: <a
moz-do-not-send="true" href="http://ad.bbg.net"
target="_blank">ad.bbg.net</a><br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): user: <a
moz-do-not-send="true"
href="mailto:bobt@ad.bbg.net" target="_blank">bobt@ad.bbg.net</a><br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): service: sshd<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): tty: ssh<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): ruser:<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): rhost: 192.168.100.157<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): authtok type: 1<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): newauthtok type: 0<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): priv: 1<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[pam_print_data] (0x0100): cli_pid: 16230<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[krb5_auth_send] (0x0100): No ccache file for user
[<a moz-do-not-send="true"
href="mailto:bobt@ad.bbg.net" target="_blank">bobt@ad.bbg.net</a>]
found.<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[fo_resolve_service_send] (0x0100): Trying to
resolve service 'IPA'<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[be_resolve_server_process] (0x0200): Found
address for server <a moz-do-not-send="true"
href="http://dc.ipa.bbg.net" target="_blank">dc.ipa.bbg.net</a>:
[192.168.100.14] TTL 3600<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[be_pam_handler_callback] (0x0100): Backend
returned: (0, 4, <NULL>) [Success]<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[be_pam_handler_callback] (0x0100): Sending result
[4][<a moz-do-not-send="true"
href="http://ad.bbg.net" target="_blank">ad.bbg.net</a>]<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[be_pam_handler_callback] (0x0100): Sent result
[4][<a moz-do-not-send="true"
href="http://ad.bbg.net" target="_blank">ad.bbg.net</a>]<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a
moz-do-not-send="true" href="http://ipa.bbg.net"
target="_blank">ipa.bbg.net</a>]]]
[child_sig_handler] (0x0100): child [16313]
finished successfully.
<div><br>
</div>
<div>Can anyone explain why it's saying account
info lookup failed when it can get the account
info fine via getent?</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Guy</div>
</div>
<br>
<fieldset></fieldset>
<br>
</blockquote>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div style="font-size:small"><img moz-do-not-send="true"
src="http://www.bluebatgames.com/wp-content/uploads/2015/10/gt-novo-1-t.png"><br>
</div>
</div>
</div>
<blockquote style="margin:0 0 0
40px;border:none;padding:0px"><b style="font-size:small">
<div style="text-align:left"><b>Guy Knights</b></div>
</b><span style="font-size:small">
<div style="text-align:left">Senior Systems Engineer</div>
</span><span style="font-size:small">
<div style="text-align:left">BlueBat Games Inc.</div>
</span><span style="font-size:small">
<div style="text-align:left">Ph: 778-379-5120</div>
</span>
<div>
<div>
<div style="text-align:left;font-size:small">Email: <a
moz-do-not-send="true"
href="mailto:guy@bluebatgames.com" target="_blank">guy@bluebatgames.com</a></div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
<br>
</body>
</html>