SSSD AD account login but home directory intermittently failing

General support questions
Post Reply
itd
Posts: 5
Joined: 2017/08/30 11:15:45

SSSD AD account login but home directory intermittently failing

Post by itd » 2017/08/30 15:52:17

Hi folks

I'm running into a frustrating problem with SSSD:

I'd like to bring AD integration of Centos 7.X boxes into production using SSSD. On several test boxes (joined to AD using realm command) everything seems to work fine at first (GUI login, SSH login). But all of a sudden login kind of fails for some (but not for all) test users (failing users have home directory not properly set anymore, $HOME= /). Home directories (path = /home/groupname/username) are mounted from an NFS server and accessible. Home dir path is set in the AD attribute "unixHomeDirectory"

Stopping sssd, clearing sss_cache (sss_cache -E) and then starting sssd again usually solves the problem for a short time (1 - 20 logins) but the annoying problem reappears. Thought it might help to disable caching of credentials... nope

Any hints are highly appreciated!
Thanks, Stefan


Here's the sssd.conf file:

Code: Select all

[sssd]
domains = my.domain.com
config_file_version = 2
services = nss, pam
#services = nss, pam, ssh, autofs

[domain/my.domain.com]
debug_level = 2
ad_domain = my.domain.com
krb5_realm = MY.DOMAIN.COM
realmd_tags = joined-with-samba
id_provider = ad
#cache_credentials = True
cache_credentials = False
krb5_store_password_if_offline = False
#krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
#fallback_homedir = /home/group1/%u

access_provider = simple
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName

User avatar
TrevorH
Forum Moderator
Posts: 27410
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: SSSD AD account login but home directory intermittently failing

Post by TrevorH » 2017/08/30 15:59:05

What's the output from rpm -q sssd ?
CentOS 6 will die in November 2020 - migrate sooner rather than later!
CentOS 5 has been EOL for nearly 3 years and should no longer be used for anything!
Full time Geek, part time moderator. Use the FAQ Luke

hunter86_bg
Posts: 1976
Joined: 2015/02/17 15:14:33
Location: Bulgaria
Contact:

Re: SSSD AD account login but home directory intermittently failing

Post by hunter86_bg » 2017/08/30 19:37:28

I think that it won't hurt to try with sssd's cache disabled. This will stress the AD a little bit , but will prove if the issue is in the sssd daemon itself.

User avatar
TrevorH
Forum Moderator
Posts: 27410
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: SSSD AD account login but home directory intermittently failing

Post by TrevorH » 2017/08/30 21:16:49

There are lots of caching related bugs in older sssd versions which is why I asked for the rpm -q output.
CentOS 6 will die in November 2020 - migrate sooner rather than later!
CentOS 5 has been EOL for nearly 3 years and should no longer be used for anything!
Full time Geek, part time moderator. Use the FAQ Luke

itd
Posts: 5
Joined: 2017/08/30 11:15:45

Re: SSSD AD account login but home directory intermittently failing

Post by itd » 2017/08/31 06:17:10

Thanks for the prompt replies!

Code: Select all

# rpm -q sssd
sssd-1.14.0-43.el7_3.18.x86_64
How to completely disable sssd's caching?
Since we have a small environment ( a few hundred systems and users) and 3 domain controllers running I guess that AD won't be stressed too much, at least for testing

hunter86_bg
Posts: 1976
Joined: 2015/02/17 15:14:33
Location: Bulgaria
Contact:

Re: SSSD AD account login but home directory intermittently failing

Post by hunter86_bg » 2017/08/31 16:24:20

I think that authconfig will do the trick.
1.Create backup of the current configuration in a safe place:

Code: Select all

authconfig --savebackup=/root/backup-2017-09-01
2.Disable caching:

Code: Select all

authconfig --disablecachecreds --disablecache --update
To restore the configuration use:

Code: Select all

authconfig --restorebackup=/root/backup-2017-09-01

itd
Posts: 5
Joined: 2017/08/30 11:15:45

Re: SSSD AD account login but home directory intermittently failing

Post by itd » 2017/09/04 15:47:38

Thanks for the hints.
At a first glance

Code: Select all

authconfig --disablecachecreds --disablecache --update
seemed to solve the problem. But after a few dozen logins the problem reappeared.
I'm now evaluating "oldfashioned" winbind integration, although RH recommends using SSS.

ehtrammir
Posts: 2
Joined: 2020/01/07 23:45:04

Re: SSSD AD account login but home directory intermittently failing

Post by ehtrammir » 2020/01/07 23:58:09

I'm also encountering similar error, to mitigate the issue Resolution we have to Cleared the SSSD cache and restart SSSD on affected host. This manual work and case interruption to schedule work. Any advise?

Post Reply

Return to “CentOS 7 - General Support”