Great, the issue is certainly in SSSD truncating the ldap URI then. I'd report the issue on the Red Hat Bugzilla against RHEL 6, report all the details of the rpm, logs, nsswitch.conf and sssd.conf. The SSSD team is pretty responsive, so I hope they can help you fix it. In the mean time you have also found a possible work around so you have a way around it. Happy to have helped! > On 23 Aug 2019, at 15:03, DaV <snowfrs@xxxxxxxxx> wrote: > > Hi William > > The nsswitch on my client is: > # > # /etc/nsswitch.conf > # > # An example Name Service Switch config file. This file should be > # sorted with the most-used services at the beginning. > # > # The entry '[NOTFOUND=return]' means that the search for an > # entry should stop if the search in the previous entry turned > # up nothing. Note that if the search failed due to some other reason > # (like no NIS server responding) then the search continues with the > # next entry. > # > # Valid entries include: > # > # nisplus Use NIS+ (NIS version 3) > # nis Use NIS (NIS version 2), also called YP > # dns Use DNS (Domain Name Service) > # files Use the local files > # db Use the local database (.db) files > # compat Use NIS on compat mode > # hesiod Use Hesiod for user lookups > # [NOTFOUND=return] Stop searching if not found so far > # > > # To use db, put the "db" in front of "files" for entries you want to be > # looked up first in the databases > # > # Example: > #passwd: db files nisplus nis > #shadow: db files nisplus nis > #group: db files nisplus nis > > passwd: files sss > shadow: files sss > group: files sss > > #hosts: db files nisplus nis dns > hosts: files dns > > # Example - obey only what nisplus tells us... > #services: nisplus [NOTFOUND=return] files > #networks: nisplus [NOTFOUND=return] files > #protocols: nisplus [NOTFOUND=return] files > #rpc: nisplus [NOTFOUND=return] files > #ethers: nisplus [NOTFOUND=return] files > #netmasks: nisplus [NOTFOUND=return] files > > bootparams: nisplus [NOTFOUND=return] files > > ethers: files > netmasks: files > networks: files > protocols: files > rpc: files > services: files sss > > netgroup: files sss > > publickey: nisplus > > automount: files sss > aliases: files nisplus > > > > Sincerely, > -- > DaV > > On Fri, Aug 23, 2019, at 13:01, William Brown wrote: >> Indeed - for one last detail can you please show me your /etc/nsswitch.conf? >> >> After that, I'd advise you to open a bug on Red Hat bugzilla against >> SSSD and include the //etc/nsswitch.conf, and the rpm and log out put >> you have provided me here. >> >> Hope that helps, and great work to debug this. >> >>> On 23 Aug 2019, at 14:49, DaV <snowfrs@xxxxxxxxx> wrote: >>> >>> Hi William, >>> I can confirm that the automount issue can be reproduced. >>> >>> My 389ds Client environment: >>> OS: CentOS release 6.9 (Final) >>> openldap: openldap-clients-2.4.40-16.el6.x86_64 >>> sssd: >>> sssd-client-1.13.3-60.el6.x86_64 >>> sssd-ipa-1.13.3-60.el6.x86_64 >>> sssd-proxy-1.13.3-60.el6.x86_64 >>> sssd-common-1.13.3-60.el6.x86_64 >>> sssd-common-pac-1.13.3-60.el6.x86_64 >>> sssd-ad-1.13.3-60.el6.x86_64 >>> sssd-ldap-1.13.3-60.el6.x86_64 >>> python-sssdconfig-1.13.3-60.el6.noarch >>> sssd-krb5-common-1.13.3-60.el6.x86_64 >>> sssd-krb5-1.13.3-60.el6.x86_64 >>> sssd-1.13.3-60.el6.x86_64 >>> >>> the sssd configuration under /etc/sssd/sssd.conf >>> [domain/default] >>> >>> autofs_provider = ldap >>> cache_credentials = False >>> ldap_search_base = dc=example,dc=com >>> krb5_realm = EXAMPLE.COM >>> krb5_server = kerberos.example.com >>> id_provider = ldap >>> auth_provider = ldap >>> chpass_provider = ldap >>> ldap_uri = ldaps://389ds.example.com >>> ldap_tls_cacertdir = /etc/openldap/cacerts >>> ldap_group_member = uniqueMember >>> ldap_schema = rfc2307bis >>> debug_level = 5 >>> >>> ldap_autofs_map_object_class = nisMap >>> ldap_autofs_map_name = nisMapName >>> ldap_autofs_entry_object_class = nisObject >>> ldap_autofs_entry_key = cn >>> ldap_autofs_entry_value = nisMapEntry >>> ldap_autofs_search_base = ou=service,dc=example,dc=com >>> ldap_id_use_start_tls = False >>> >>> [sssd] >>> services = nss, pam, autofs >>> filter_users = root >>> filter_groups = root >>> domains = default >>> [nss] >>> homedir_substring = /home >>> >>> [pam] >>> >>> [sudo] >>> >>> [autofs] >>> debug_level = 9 >>> >>> [ssh] >>> >>> [pac] >>> >>> [ifp] >>> >>> >>> to compare the difference, I have two LDAP automount entry on 389ds server. >>> # /tools, auto.master, service, example.com >>> dn: cn=/tools,nismapname=auto.master,ou=service,dc=example,dc=com >>> nisMapName: tools >>> objectClass: nisObject >>> objectClass: top >>> cn: /tools >>> nisMapEntry: ldap tc-389ds-1.example.com:nismapname=auto.tools,ou=service,dc=example,dc=com >>> >>> # /home, auto.master, service, example.com >>> dn: cn=/home,nismapname=auto.master,ou=service,dc=example,dc=com >>> nisMapName: home >>> objectClass: nisObject >>> objectClass: top >>> cn: /home >>> nisMapEntry: ldap 389ds.example.com:nismapname=auto.home,ou=service,dc=example,dc=com >>> >>> >>> When I restart autofs on client, I get message: >>> >>> Aug 23 12:28:03 centos6 automount[1887]: autofs stopped >>> Aug 23 12:28:05 centos6 automount[3051]: Starting automounter version 5.0.5-139.el6, master map auto.master >>> Aug 23 12:28:05 centos6 automount[3051]: using kernel protocol version 5.02 >>> Aug 23 12:28:05 centos6 automount[3051]: lookup_nss_read_master: reading master files auto.master >>> Aug 23 12:28:05 centos6 automount[3051]: do_init: parse(sun): init gathered global options: (null) >>> Aug 23 12:28:05 centos6 automount[3051]: lookup_read_master: lookup(file): read entry +auto.master >>> Aug 23 12:28:05 centos6 automount[3051]: lookup_nss_read_master: reading master files auto.master >>> Aug 23 12:28:05 centos6 automount[3051]: do_init: parse(sun): init gathered global options: (null) >>> Aug 23 12:28:05 centos6 automount[3051]: lookup_nss_read_master: reading master sss auto.master >>> Aug 23 12:28:05 centos6 automount[3051]: do_init: parse(sun): init gathered global options: (null) >>> Aug 23 12:28:05 centos6 automount[3051]: lookup(file): failed to read included master map auto.master >>> >>> Aug 23 12:28:05 centos6 automount[3051]: master_do_mount: mounting /tools >>> Aug 23 12:28:05 centos6 automount[3051]: automount_path_to_fifo: fifo name /var/run/autofs.fifo-tools >>> Aug 23 12:28:05 centos6 automount[3051]: lookup_nss_read_map: reading map ldap ldap:tc-389ds-1.example.com:nismapname=auto.tools,ou=service,dc=example,dc=com >>> Aug 23 12:28:05 centos6 automount[3051]: parse_server_string: lookup(ldap): Attempting to parse LDAP information from string "ldap:tc-389ds-1.example.com:nismapname=auto.tools,ou=service,dc=example,dc=com". >>> Aug 23 12:28:05 centos6 automount[3051]: parse_server_string: lookup(ldap): server "ldap://tc-389ds-1.example.com/";, base dn "nismapname=auto.tools,ou=service,dc=example,dc=com" >>> Aug 23 12:28:05 centos6 automount[3051]: parse_ldap_config: lookup(ldap): ldap authentication configured with the following options: >>> Aug 23 12:28:05 centos6 automount[3051]: parse_ldap_config: lookup(ldap): use_tls: 0, tls_required: 0, auth_required: 1, sasl_mech: (null) >>> Aug 23 12:28:05 centos6 automount[3051]: parse_ldap_config: lookup(ldap): user: (null), secret: unspecified, client principal: (null) credential cache: (null) >>> Aug 23 12:28:05 centos6 automount[3051]: do_init: parse(sun): init gathered global options: (null) >>> Aug 23 12:28:05 centos6 automount[3051]: read_one_map: map read not needed, so not done >>> Aug 23 12:28:05 centos6 automount[3051]: mounted indirect on /tools with timeout 300, freq 75 seconds >>> Aug 23 12:28:05 centos6 automount[3051]: st_ready: st_ready(): state = 0 path /tools >>> >>> Aug 23 12:28:05 centos6 automount[3051]: master_do_mount: mounting /home >>> Aug 23 12:28:05 centos6 automount[3051]: automount_path_to_fifo: fifo name /var/run/autofs.fifo-home >>> Aug 23 12:28:05 centos6 automount[3051]: lookup_nss_read_map: reading map ldap ldap:ds.example.com:nismapname=auto.home,ou=service,dc=example,dc=com >>> Aug 23 12:28:05 centos6 automount[3051]: parse_server_string: lookup(ldap): Attempting to parse LDAP information from string "ldap:ds.example.com:nismapname=auto.home,ou=service,dc=example,dc=com". >>> Aug 23 12:28:05 centos6 automount[3051]: parse_server_string: lookup(ldap): server "ldap://ds.example.com/";, base dn "nismapname=auto.home,ou=service,dc=example,dc=com" >>> Aug 23 12:28:05 centos6 automount[3051]: parse_ldap_config: lookup(ldap): ldap authentication configured with the following options: >>> Aug 23 12:28:05 centos6 automount[3051]: parse_ldap_config: lookup(ldap): use_tls: 0, tls_required: 0, auth_required: 1, sasl_mech: (null) >>> Aug 23 12:28:05 centos6 automount[3051]: parse_ldap_config: lookup(ldap): user: (null), secret: unspecified, client principal: (null) credential cache: (null) >>> Aug 23 12:28:05 centos6 automount[3051]: do_init: parse(sun): init gathered global options: (null) >>> Aug 23 12:28:05 centos6 automount[3051]: read_one_map: map read not needed, so not done >>> Aug 23 12:28:05 centos6 automount[3051]: mounted indirect on /home with timeout 300, freq 75 seconds >>> Aug 23 12:28:05 centos6 automount[3051]: st_ready: st_ready(): state = 0 path /home >>> Aug 23 12:28:16 centos6 automount[3051]: handle_packet: type = 3 >>> Aug 23 12:28:16 centos6 automount[3051]: handle_packet_missing_indirect: token 5, name ithelpdesk, request pid 1700 >>> Aug 23 12:28:16 centos6 automount[3051]: attempting to mount entry /home/ithelpdesk >>> Aug 23 12:28:16 centos6 automount[3051]: lookup_mount: lookup(ldap): looking up ithelpdesk >>> Aug 23 12:28:16 centos6 automount[3051]: do_bind: lookup(ldap): auth_required: 1, sasl_mech (null) >>> Aug 23 12:28:16 centos6 automount[3051]: bind_ldap_simple: lookup(ldap): Unable to bind to the LDAP server: , error Can't contact LDAP server >>> Aug 23 12:28:16 centos6 automount[3051]: do_bind: lookup(ldap): ldap simple bind returned -1 >>> Aug 23 12:28:16 centos6 automount[3051]: lookup(ldap): lookup for ithelpdesk failed: connection failed >>> Aug 23 12:28:16 centos6 automount[3051]: key "ithelpdesk" not found in map source(s). >>> Aug 23 12:28:16 centos6 automount[3051]: dev_ioctl_send_fail: token = 5 >>> Aug 23 12:28:16 centos6 automount[3051]: failed to mount /home/ithelpdesk >>> Aug 23 12:28:16 centos6 automount[3051]: handle_packet: type = 3 >>> Aug 23 12:28:16 centos6 automount[3051]: handle_packet_missing_indirect: token 6, name ithelpdesk, request pid 1700 >>> Aug 23 12:28:16 centos6 automount[3051]: dev_ioctl_send_fail: token = 6 >>> Aug 23 12:28:16 centos6 automount[3051]: handle_packet: type = 3 >>> Aug 23 12:28:16 centos6 automount[3051]: handle_packet_missing_indirect: token 7, name ithelpdesk, request pid 1700 >>> Aug 23 12:28:16 centos6 automount[3051]: dev_ioctl_send_fail: token = 7 >>> >>> You can see the prefix 389 is gone. When I want to go to /home/ithelpdesk, client log shows >>> Unable to bind to the LDAP server, error can't contact LDAP server. >>> Because the client try to connect to ds.example.com, not 389ds.example.com >>> >>> >>> Sincerely, >>> -- >>> DaV >>> >>> On Fri, Aug 23, 2019, at 10:08, William Brown wrote: >>>> >>>> >>>>> On 23 Aug 2019, at 11:03, DaV <snowfrs@xxxxxxxxx> wrote: >>>>> >>>>> Hi William, >>>>> >>>>>> So, where did you read the docs on the setup? Maybe the docs are incomplete? >>>>> We are using Sun directory Server version 7, the configure on 389ds copied from Sun Directory Server for the automount part. >>>>> >>>>>> Can you correctly do a "ldapsearch" or "ldapwhoami" with -H >>>>>> ldap://389ds.example.com? >>>>> YES. the ldapsearch can work propertly. Just the automount part has some issue. >>>>> I will double check this today and reply. Thanks! >>>> >>>> In that case, it would be best to see how automount is configured on >>>> your centos host, and what rpm versions are involved. Thanks! >>>> >>>>> >>>>> Sincerely, >>>>> -- >>>>> DaV >>>>> >>>>> On Fri, Aug 23, 2019, at 08:53, William Brown wrote: >>>>>> >>>>>> >>>>>>> On 23 Aug 2019, at 10:39, DaV <snowfrs@xxxxxxxxx> wrote: >>>>>>> >>>>>>> Hi all, >>>>>>> First of all, I don't know whether if this is a bug and I don't know where to submit a bug. >>>>>> >>>>>> Let's do some investigation here first, but then I'd advise the RH >>>>>> bugzilla if we determine what the cause is. >>>>>> >>>>>>> >>>>>>> My 389ds info: >>>>>>> OS: CentOS Linux release 7.6.1810 (Core) >>>>>>> 389ds: 389-ds-base-1.3.8.4-15.el7.x86_64 >>>>>>> >>>>>>> On 389ds server, I have configured like this >>>>>>>> # auto.master, service, example.com >>>>>>>> dn: nismapname=auto.master,ou=service,dc=example,dc=com >>>>>>>> nisMapName: auto.master >>>>>>>> objectClass: nisMap >>>>>>>> objectClass: top >>>>>>>> >>>>>>>> # /home, auto.master, service, example.com >>>>>>>> dn: cn=/home,nismapname=auto.master,ou=service,dc=example,dc=com >>>>>>>> nisMapName: home >>>>>>>> objectClass: nisObject >>>>>>>> objectClass: top >>>>>>>> cn: /home >>>>>>>> nisMapEntry: ldap 389ds.example.com >>>>>>>> >>>>>>>> # *, auto.home, service, example.com >>>>>>>> dn: cn=*,nismapname=auto.home,ou=service,dc=example,dc=com >>>>>>>> nisMapName: home >>>>>>>> nisMapEntry: -fstype=nfs4,defaults,_netdev,acl sun:/home/& >>>>>>>> objectClass: nisObject >>>>>>>> objectClass: top >>>>>>>> cn: *:nismapname=auto.home,ou=service,dc=example,dc=com >>>>>>>> >>>>>>> >>>>>>> On client side >>>>>>> When I want to change directory under home (cd /home/username), I can't. >>>>>>> So I enable the autofs debug mode, and I see some message like this >>>>>>> >>>>>>>> Aug 22 15:55:36 centos automount[2424]: parse_server_string: lookup(ldap): server "ldap://ds.example.com/";, base dn "nismapname=auto.home,ou=service,dc=example,dc=com" >>>>>>> >>>>>>> The prefix 389 has gone. The client says can't connect LDAP server because in 389ds server I write ldap 389ds.example.com but I see ds.example.com on client-side. >>>>>>> >>>>>>> I don't know whether this is a bug. Just write this to let you know. Thanks! >>>>>> >>>>>> So, where did you read the docs on the setup? Maybe the docs are incomplete? >>>>>> >>>>>> What client tool are you using to read the mount? I seem to recall sssd >>>>>> has some stuff for it, or automount directly does. Seeing your >>>>>> automount "configs" would help here. >>>>>> >>>>>> Can you correctly do a "ldapsearch" or "ldapwhoami" with -H >>>>>> ldap://389ds.example.com? >>>>>> >>>>>> Anyway, it seems like a url/uri parsing issue, so let's work out what >>>>>> part is failing :) >>>>>> >>>>>>> >>>>>>> >>>>>>> My solution is: >>>>>>> change the 389ds server-side using nisMapEntry: ldap tc-389ds.example.com. >>>>>>> >>>>>>> >>>>>>> >>>>>>> Sincerely, >>>>>>> -- >>>>>>> DaV >>>>>>> >>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx >>>>>>> To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx >>>>>>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>>>>>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>>>>>> List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx >>>>>> >>>>>> — >>>>>> Sincerely, >>>>>> >>>>>> William Brown >>>>>> >>>>>> Senior Software Engineer, 389 Directory Server >>>>>> SUSE Labs >>>>>> _______________________________________________ >>>>>> 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx >>>>>> To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx >>>>>> Fedora Code of Conduct: >>>>>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>>>>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>>>>> List Archives: >>>>>> https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx >>>>>> >>>> >>>> — >>>> Sincerely, >>>> >>>> William Brown >>>> >>>> Senior Software Engineer, 389 Directory Server >>>> SUSE Labs >>>> >>>> >> >> — >> Sincerely, >> >> William Brown >> >> Senior Software Engineer, 389 Directory Server >> SUSE Labs >> >> — Sincerely, William Brown Senior Software Engineer, 389 Directory Server SUSE Labs _______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
