ldap_autofs_search_base not domain based
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
sssd (Ubuntu) |
New
|
Medium
|
Unassigned |
Bug Description
Hi,
The search base parameter for autofs was intented to be set for each domain separately, but it fails to do so. The value of the first occurence of the parameter somehow is set for all domain sections.
I'm posting example configuration below. There are 2 domains, and in this case the ldap_autofs_
I have used subdomain in the example and it might be confusing, but nevertheles, I did bunch of tests including completely different domains with same results. In a contrary the sudo_search_base is working just fine.
I tried including scope as well, but it didnt help. I was tracking the ldap request on the ldap server side when autofs service is restarted. It always searches for one record, there is no additional request for the other domain (I'm posting the logs too)
Environment:
Ubuntu Server 14.04.5 LTS x86_64
SSSD 1.11.8-0ubuntu0.2
CONFIGURATION
[sssd]
config_file_version = 2
reconnection_
sbus_timeout = 30
services = nss, pam, sudo, autofs
domains = skp.fids, fids
[nss]
filter_groups = root
filter_users = root
reconnection_
[pam]
reconnection_
[autofs]
[domain/skp.fids]
; Using enumerate = true leads to high load and slow response
enumerate = false
cache_credentials = false
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
autofs_provider = ldap
ldap_uri = ldap://
ldap_search_base = dc=skp,dc=fids
ldap_sudo_
ldap_autofs_
ldap_tls_reqcert = never
krb5_kdcip = kerberos.skp.fids
krb5_realm = SKP.FIDS
krb5_changepw_
krb5_auth_timeout = 15
krb5_renewable_
[domain/fids]
; Using enumerate = true leads to high load and slow response
enumerate = false
cache_credentials = false
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
autofs_provider = ldap
ldap_uri = ldap://
ldap_search_base = dc=fids
ldap_uri = ldap://
ldap_search_base = dc=fids
ldap_sudo_
ldap_autofs_
ldap_tls_reqcert = never
krb5_kdcip = kerberos.skp.fids
krb5_realm = FIDS
krb5_changepw_
krb5_auth_timeout = 15
krb5_renewable_
LOGS (this is the only request in the logs)
...
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=1 SRCH base="ou=
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=1 SRCH attr=objectClass ou
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
Oct 22 12:15:41 vav slapd[1294]: conn=1077 fd=25 ACCEPT from IP=192.
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=2 SRCH base="ou=
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=2 SRCH attr=objectClass cn automountInform
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text=
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=3 SRCH base="ou=
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=3 SRCH attr=objectClass ou
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text=
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=4 SRCH base="ou=
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=4 SRCH attr=objectClass cn automountInform
Oct 22 12:15:41 vav slapd[1294]: conn=1077 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text=
Oct 22 12:15:49 vav slapd[1294]: conn=1077 op=5 SRCH base="ou=
...
description: | updated |
Changed in sssd (Ubuntu): | |
importance: | Undecided → Medium |
I think the issue might be different, because the autofs search base is only read by the domain itself and the domains cannot affect one another. So I suspect the autofs responder is not moving to another domain once it finds the auto.master map in the first iteration.
But we need logs to see what's going on, please follow https:/ /fedorahosted. org/sssd/ wiki/Troublesho oting