Review your favorite Linux distribution.
Go Back > Forums > Linux Forums > Linux - Software
User Name
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.


  Search this Thread
Old 01-02-2017, 07:49 AM   #1
LQ Newbie
Registered: Sep 2011
Posts: 7

Rep: Reputation: Disabled
SSSD/Active directory problem

I am having some problems with sssd site discovery.
Our Active Directory has several sites, each with associated subnets.
I installed two RHEL 7.1 servers, and joind our domain using realmd join
Everything works quite nicel and I can login with AD users to my machines.

For some reason, one of my hosts decides that he is in site A, while the other one sees itself as part of site B - and therefore uses a far away DC, which causes some problems.

When I define the DC manually with ad_server in sssd.conf, it works ok - but then I lose the site discovery option.

Both machines have:
1. The same sssd.conf file
2. The same resolv.conf file
3. Are residing in the same subnet.

Here is the sssd.conf:

domains = my.domain
config_file_version = 2
services = nss, pam


ad_domain = my.domain
krb5_realm = MY.DOMAIN
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
ad_gpo_access_control = enforcing
fallback_homedir = /home/%d/%u
access_provider = ad
ignore_group_members = true
debug_level = 9

Here are some of the log lines from the problematic host (incorrectly finding the 'B' site):

[root@mongodev sssd]# grep "Found site" /var/log/sssd/*

/var/log/sssd/ Jan 1 04:09:34 2017) [sssd[be[]]] [ad_master_domain_netlogon_done] (0x0400): Found site [B].
/var/log/sssd/ Jan 1 04:30:51 2017) [sssd[be[]]] [ad_get_client_site_done] (0x0400): Found site: B
<many such lines...>

...While the other host returns correctly:
[root@dbalnx1 sssd]# grep "Found site" /var/log/sssd/*
/var/log/sssd/ Jan 1 06:11:36 2017) [sssd[be[]]] [ad_master_domain_netlogon_done] (0x0400): Found site [A].
/var/log/sssd/ Jan 1 06:18:29 2017) [sssd[be[]]] [ad_get_client_site_done] (0x0400): Found site: A
<many such lines>

Can anyone help? Why is the incorrect site/DC selected consistently on one host?
Old 01-15-2017, 11:09 AM   #2
Registered: Apr 2010
Location: Cluj, Romania
Distribution: Debian Testing
Posts: 731

Rep: Reputation: 157Reputation: 157
That is auto discovery. We use sssd and unless we specify the DC manually it randomly selected one of our DCs, some are thousands of miles and several hundred ms away and incurring a few seconds of waiting (sometimes timeouts).
There is a setting that adds auto discovery fall back if the first server is not found:

ad_server = dc.your.domain,_srv_

It does work consistently using the specified first server and it does seem to fall back to auto discovered DCs.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Ubuntu 14.04 Active Directory Integration With SSSD athreyavc Linux - Server 5 02-03-2016 03:25 AM
Active Directory Integration with SSSD TheRyaz Red Hat 3 07-13-2015 02:39 PM
Winbind or SSSD for Active Directory authentication megamaced Linux - Networking 2 12-20-2014 02:39 PM
SSSD response inconsistent with Active Directory abhi001neo Linux - Newbie 0 09-24-2014 05:44 AM
Winbind / KRB / SSSD / Active Directory Howto? rrue Linux - Server 2 10-11-2012 12:48 PM > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 03:46 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration