<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hi,</div><div><br data-mce-bogus="1"></div><div>I have trouble with resolving AD users from my IPA clients.</div><div><br data-mce-bogus="1"></div><div>Environment: 2x IPA server with trust into AD - both IPA servers and clients running latest rhel 7.3.</div><div><br data-mce-bogus="1"></div><div>IPA domain: vs.example.com</div><div>AD domain: example.com, cen.example.com</div><div><br data-mce-bogus="1"></div><div>All tstxxxxx users are in cen.example.com but their UPN is set to tstxxxxx@example.com</div><div><br data-mce-bogus="1"></div><div>I can run id and getent passwd commands without problem from both IPA servers:</div><div><br data-mce-bogus="1"></div><div>id tst99655@example.com</div><div>uid=20018(tst99655@cen.example.com) gid=5001(csunix) groups=5001(csunix),930000008(final_test_group)<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>getent tst99655@example.com </div><div>tst99655@cen.example.com:*:20018:5001:ipa_test:/home/cen.example.com/tst99655:/bin/bash<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>But from client:</div><div><br></div><div><div style="orphans: 2; text-align: start; text-indent: 0px; widows: 2;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;" style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">root@trh7clnt02:~# id tst99655@example.com</div><div data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;" style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">id: tst99655@example.com: no such user</div><div data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;" style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; display: inline !important; float: none;">root@trh7clnt02:~#getent passwd tst99655@example.com</span><div style="clear: both;" data-mce-style="clear: both;">... no reply</div></div><div data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;" style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; display: inline !important; float: none;"><br data-mce-bogus="1"></span></div><div data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;" style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br></div><div style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">But when I run on client:</div><div style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">getent group csunix@cen.example.com - it takes more then 30s</div><div>csunix@cen.example.com:*:5001: .... and really long list of users</div><div><br></div><div>Then again from client:</div><div><div><br></div><div>root@trh7clnt02:~# id tst99655@example.com</div><div>uid=20018(tst99655@cen.example.com) gid=5001(csunix) groups=5001(csunix)</div><div><br></div><div>root@trh7clnt02:~# getent passwd tst99655@example.com</div><div>tst99655@cen.example.com:*:20018:5001:ipatest:/home/cen.example.com/tst99655:/bin/bash</div><div><br></div><div>This time it works and it keeps working until I clean the sssd cache on client. Then I have to run that getent group csunix command again.</div><div><br></div><div>I would say it is some timeout issue with enumerating csunix group. I have tried to fix it by adding:</div><div><br></div><div>ldap_search_timeout = 50</div><div><br></div><div>into sssd.conf on both server and client(sssd restarted), but without effect.</div><div>Here is my sssd.conf from client:</div><div><div><br></div><div>[domain/vs.example.com]</div><div>debug_level = 7</div><div>cache_credentials = True</div><div>krb5_store_password_if_offline = True</div><div>ipa_domain = vs.example.com</div><div>id_provider = ipa</div><div>auth_provider = ipa</div><div>access_provider = ipa</div><div>ipa_hostname = trh7clnt02.vs.example.com</div><div>chpass_provider = ipa</div><div>ipa_server = tidmipa01.vs.example.com</div><div>ldap_tls_cacert = /etc/ipa/ca.crt</div><div>ldap_search_timeout = 50</div><div><br></div><div>[sssd]</div><div>services = nss, sudo, pam, ssh</div><div>config_file_version = 2</div><div>domains = vs.example.com</div><div>[nss]</div><div>homedir_substring = /home</div><div>debug_level = 7</div><div>[pam]</div><div>debug_level = 7</div><div>[sudo]</div><div>[autofs]</div><div>[ssh]</div><div>[pac]</div><div>debug_level = 7</div><div>[ifp]</div></div><div><br></div><div>IPA server sssd.conf:</div><div><div><br></div><div>[domain/vs.example.com]</div><div>debug_level = 7</div><div>cache_credentials = True</div><div>krb5_store_password_if_offline = True</div><div>ipa_domain = vs.example.com</div><div>id_provider = ipa</div><div>auth_provider = ipa</div><div>access_provider = ipa</div><div>ipa_hostname = tidmipa01.vs.example.com</div><div>chpass_provider = ipa</div><div>ipa_server = tidmipa01.vs.example.com</div><div>ipa_server_mode = True</div><div>ldap_tls_cacert = /etc/ipa/ca.crt</div><div>ldap_id_mapping = False</div><div>ldap_search_timeout = 20</div><div>[sssd]</div><div>services = nss, sudo, pam, ssh</div><div>config_file_version = 2</div><div>domains = vs.example.com</div><div>[nss]</div><div>memcache_timeout = 600</div><div>debug_level = 7</div><div>homedir_substring = /home</div><div>[pam]</div><div>debug_level = 7</div><div>[sudo]</div><div>debug_level = 7</div><div>[autofs]</div><div>debug_level = 7</div><div>[ssh]</div><div>debug_level = 7</div><div>[pac]</div><div>debug_level = 7</div><div>[ifp]</div><div>debug_level = 7</div></div><div><br></div><div>Any suggestion how to fix that ? I can add logs from both successful and unsuccessful try but they are quite long.</div><div><br></div><div style="clear: both;" data-mce-style="clear: both;">Thank you.</div></div><div><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; display: inline !important; float: none;"></span>Jan</div></div></div><div style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br></div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div></div><div data-marker="__SIG_PRE__"></div></div></body></html>