SSSD AD account login but home directory intermittently failing

[itd]

Hi folks

I'm running into a frustrating problem with SSSD:

I'd like to bring AD integration of Centos 7.X boxes into production using SSSD. On several test boxes (joined to AD using realm command) everything seems to work fine at first (GUI login, SSH login). But all of a sudden login kind of fails for some (but not for all) test users (failing users have home directory not properly set anymore, $HOME= /). Home directories (path = /home/groupname/username) are mounted from an NFS server and accessible. Home dir path is set in the AD attribute "unixHomeDirectory"

Stopping sssd, clearing sss_cache (sss_cache -E) and then starting sssd again usually solves the problem for a short time (1 - 20 logins) but the annoying problem reappears. Thought it might help to disable caching of credentials... nope

Any hints are highly appreciated!
Thanks, Stefan


Here's the sssd.conf file:

Code: Select all

[sssd]
domains = my.domain.com
config_file_version = 2
services = nss, pam
#services = nss, pam, ssh, autofs

[domain/my.domain.com]
debug_level = 2
ad_domain = my.domain.com
krb5_realm = MY.DOMAIN.COM
realmd_tags = joined-with-samba
id_provider = ad
#cache_credentials = True
cache_credentials = False
krb5_store_password_if_offline = False
#krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
#fallback_homedir = /home/group1/%u

access_provider = simple
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName

[TrevorH]

What's the output from rpm -q sssd ?

[hunter86_bg]

I think that it won't hurt to try with sssd's cache disabled. This will stress the AD a little bit , but will prove if the issue is in the sssd daemon itself.

[TrevorH]

There are lots of caching related bugs in older sssd versions which is why I asked for the rpm -q output.

[itd]

Thanks for the prompt replies!

Code: Select all

# rpm -q sssd
sssd-1.14.0-43.el7_3.18.x86_64

How to completely disable sssd's caching?
Since we have a small environment ( a few hundred systems and users) and 3 domain controllers running I guess that AD won't be stressed too much, at least for testing

[hunter86_bg]

I think that authconfig will do the trick.
1.Create backup of the current configuration in a safe place:

Code: Select all

authconfig --savebackup=/root/backup-2017-09-01

2.Disable caching:

Code: Select all

authconfig --disablecachecreds --disablecache --update

To restore the configuration use:

Code: Select all

authconfig --restorebackup=/root/backup-2017-09-01

[itd]

Thanks for the hints.
At a first glance

Code: Select all

authconfig --disablecachecreds --disablecache --update

seemed to solve the problem. But after a few dozen logins the problem reappeared.
I'm now evaluating "oldfashioned" winbind integration, although RH recommends using SSS.

[ehtrammir]

I'm also encountering similar error, to mitigate the issue Resolution we have to Cleared the SSSD cache and restart SSSD on affected host. This manual work and case interruption to schedule work. Any advise?