LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 01-02-2017, 08:49 AM   #1
jstilby
LQ Newbie
 
Registered: Sep 2011
Posts: 7

Rep: Reputation: Disabled
SSSD/Active directory problem


Hi,
I am having some problems with sssd site discovery.
Our Active Directory has several sites, each with associated subnets.
I installed two RHEL 7.1 servers, and joind our domain using realmd join
Everything works quite nicel and I can login with AD users to my machines.

HOWEVER:
For some reason, one of my hosts decides that he is in site A, while the other one sees itself as part of site B - and therefore uses a far away DC, which causes some problems.

When I define the DC manually with ad_server in sssd.conf, it works ok - but then I lose the site discovery option.

Both machines have:
1. The same sssd.conf file
2. The same resolv.conf file
3. Are residing in the same subnet.

Here is the sssd.conf:



[sssd]
domains = my.domain
config_file_version = 2
services = nss, pam


[domain/my.domain]

ad_domain = my.domain
krb5_realm = MY.DOMAIN
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
ad_gpo_access_control = enforcing
fallback_homedir = /home/%d/%u
access_provider = ad
ignore_group_members = true
debug_level = 9

Here are some of the log lines from the problematic host (incorrectly finding the 'B' site):

[root@mongodev sssd]# grep "Found site" /var/log/sssd/sssd_ad.boi.gov.il.log*

/var/log/sssd/sssd_ad.boi.gov.il.logSun Jan 1 04:09:34 2017) [sssd[be[ad.boi.gov.il]]] [ad_master_domain_netlogon_done] (0x0400): Found site [B].
/var/log/sssd/sssd_ad.boi.gov.il.logSun Jan 1 04:30:51 2017) [sssd[be[ad.boi.gov.il]]] [ad_get_client_site_done] (0x0400): Found site: B
<many such lines...>

...While the other host returns correctly:
[root@dbalnx1 sssd]# grep "Found site" /var/log/sssd/sssd_ad.boi.gov.il.log*
/var/log/sssd/sssd_ad.boi.gov.il.logSun Jan 1 06:11:36 2017) [sssd[be[ad.boi.gov.il]]] [ad_master_domain_netlogon_done] (0x0400): Found site [A].
/var/log/sssd/sssd_ad.boi.gov.il.logSun Jan 1 06:18:29 2017) [sssd[be[ad.boi.gov.il]]] [ad_get_client_site_done] (0x0400): Found site: A
<many such lines>

Can anyone help? Why is the incorrect site/DC selected consistently on one host?
 
Old 01-15-2017, 12:09 PM   #2
gradinaruvasile
Member
 
Registered: Apr 2010
Location: Cluj, Romania
Distribution: Debian Testing
Posts: 731

Rep: Reputation: 155Reputation: 155
That is auto discovery. We use sssd and unless we specify the DC manually it randomly selected one of our DCs, some are thousands of miles and several hundred ms away and incurring a few seconds of waiting (sometimes timeouts).
There is a setting that adds auto discovery fall back if the first server is not found:

ad_server = dc.your.domain,_srv_

It does work consistently using the specified first server and it does seem to fall back to auto discovered DCs.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Ubuntu 14.04 Active Directory Integration With SSSD athreyavc Linux - Server 5 02-03-2016 04:25 AM
Active Directory Integration with SSSD TheRyaz Red Hat 3 07-13-2015 03:39 PM
Winbind or SSSD for Active Directory authentication megamaced Linux - Networking 2 12-20-2014 03:39 PM
SSSD response inconsistent with Active Directory abhi001neo Linux - Newbie 0 09-24-2014 06:44 AM
Winbind / KRB / SSSD / Active Directory Howto? rrue Linux - Server 2 10-11-2012 01:48 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 03:25 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration