# Rocky 9.3 + SSSD + Active Directory Domain Users **URL:** \ **Category:** Rocky Linux Help & Support\ **Tags:** rocky-linux-9\ **Created:** [February 5, 2024, 10:36am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752 "2024-02-05T10:36:28Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![muralidhara](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@muralidhara](https://forums.rockylinux.org/u/muralidhara)\ **Post date:** [February 5, 2024, 10:36am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/1 "2024-02-05T10:36:28Z")
I am facing issue with Domain Users ( AD 2012R2 ) in rocky 9.3 with sssd configuration. only user with Domain Admin are able to login, other users ie Domain Users sssd config file [sssd] domains = [example.com](http://example.com) config\_file\_version = 2 services = nss, pam debug\_level = 9 [domain/example.com] default\_shell = /bin/bash krb5\_store\_password\_if\_offline = True cache\_credentials = True krb5\_realm = [EXAMPLE.COM](http://EXAMPLE.COM) realmd\_tags = manages-system joined-with-adcli id\_provider = ad fallback\_homedir = /home/%u@%d ad\_domain = [example.com](http://example.com) use\_fully\_qualified\_names = False ldap\_id\_mapping = False access\_provider = ad enumerate = True log messages in sssd\_nss.log [nss] [sysdb\_enumpwent\_filter] (0x1000): [CID#9] Searching timestamp cache with [(objectCategory=user)] - (2024-02-05 12:44:22): [nss] [sysdb\_cache\_search\_users] (0x2000): [CID#9] Search users with filter: (&(objectCategory=user)(objectCategory=user)) [nss] [cache\_req\_search\_ncache\_filter] (0x0400): [CID#8] CR #14: This request type does not support filtering result by negative cache [nss] [cache\_req\_create\_and\_add\_result] (0x0400): [CID#10] CR #17: Found 27 entries in domain Domain Users entries are not getting listed when " getent passwd " command is run. ---
**Author:** ![linde](https://avatars.discourse-cdn.com/v4/letter/l/e36b37/32.png) [@linde](https://forums.rockylinux.org/u/linde)\ **Post date:** [February 6, 2024, 2:06am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/2 "2024-02-06T02:06:01Z")
How many users are in your domain (at least approximately)? And do you get results running `getent passwd {username}` for specific domain users? If your domain is large, enumeration will cause trouble for you. And “large” in this case is likely to be a lot smaller than you would think. ---
**Author:** ![muralidhara](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@muralidhara](https://forums.rockylinux.org/u/muralidhara)\ **Post date:** [February 6, 2024, 3:28am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/3 "2024-02-06T03:28:05Z")
around 200+ users are there in the domain, I enable enumerate for checking even after removing and try to fetch the user for the getent passwd username out put is blank . when i did try with my user name its getting the data, my user is of Domain Admin. [root@rocky-01 ~]# getent passwd mkarigowda mkarigowda:\*:20835:400:Muralidhara Karigowda:/home/mkarigowda:/bin/tcsh [root@rocky-01 ~]# getent passwd vgali if I do ldapsearch for the user user data is getting dispalyed. [root@rocky-01 ~]# /usr/bin/ldapsearch -LLL -x -H ldap://xxxx.com -D “CN=ldapadmin,OU=service-accounts,OU=systems,OU=users,OU=active,OU=xxxxx,DC=xxxx,DC=com” -b “DC=xxxx,DC=com” -s sub “sAMAccountName=vgali” cn uidNumber gidNumber unixHomeDirectory -W Enter LDAP Password: dn: CN=vgali,OU=Enable\_USB\_DVD\_Access,OU=users,OU=active,OU=xxxx,DC=xxxx,DC=com cn: vgali uidNumber: 21153 gidNumber: 400 unixHomeDirectory: /home/vgali #refldap://ForestDnsZones.xxxxx.com/DC=ForestDnsZones,DC=xxxxx,DC=com #refldap://DomainDnsZones.xxxxx.com/DC=DomainDnsZones,DC=xxxx,DC=com #refldap://xxxx.com/CN=Configuration,DC=xxxx,DC=com output of ldapsearch for my user. dn: CN=Muralidhara Karigowda,OU=users,OU=systems,OU=users,OU=active,OU=xxxx,DC=xxxxx,DC=com cn: Muralidhara Karigowda uidNumber: 20835 gidNumber: 400 unixHomeDirectory: /home/mkarigowda ---
**Author:** ![linde](https://avatars.discourse-cdn.com/v4/letter/l/e36b37/32.png) [@linde](https://forums.rockylinux.org/u/linde)\ **Post date:** [February 6, 2024, 7:43am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/4 "2024-02-06T07:43:45Z")
Here are some steps I’d recommend to troubleshoot the issue. 1. Check permissions on the active directory objects to make sure object permissions are not the problem. For both the mkarigowda and vgali accounts, check the effective permissions that your rocky-01 computer object has on the accounts. (You should see read access to many attributes, but mostly you’ll want to confirm whether effective access is the same to both accounts.) 2. Try to get some “clean” log data from when the system queries one of the accounts that you’re having trouble with (e.g. vgali). Use the timestamps output from the date commands to help identify relevant entries from the sssd logs. ---
**Author:** ![muralidhara](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@muralidhara](https://forums.rockylinux.org/u/muralidhara)\ **Post date:** [February 7, 2024, 5:13am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/5 "2024-02-07T05:13:58Z")
Object permission for both mkarigowda and vgali are having the same, as suggest cleared log and after i run the command not out put in the terminal and no logs generated for that time stamp. checked all log file cssd\_xxx.domain.log,sssd.log,sssd\_pac.log,sssd\_pam.log,sssd\_nss.log . I was check sssd\_xxxx.com.log i came across below message. - (2024-02-06 2:20:21): [be[[xxxxx.com](http://xxxxx.com)]] [sysdb\_set\_entry\_attr] (0x0080): Cannot set TS attrs for [name=mkarigowda@xxxxx.com](mailto:name=mkarigowda@xxxxx.com),cn=users,[cn=xxxxx.com](http://cn=xxxxx.com),cn=sysdb - (2024-02-06 2:20:21): [be[[xxxxx.com](http://xxxxx.com)]] [sysdb\_set\_entry\_attr] (0x0200): Entry [name=mkarigowda@xxx.com,cn=users,[cn=xxxxx.com](http://cn=xxxxx.com),cn=sysdb] has set [cache] attrs. ---
**Author:** ![linde](https://avatars.discourse-cdn.com/v4/letter/l/e36b37/32.png) [@linde](https://forums.rockylinux.org/u/linde)\ **Post date:** [February 8, 2024, 2:50am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/6 "2024-02-08T02:50:13Z")
Try adding `debug_level = 9` under the `[domain/example.com]` section in your SSSD config file. It may also be worthwhile manually clearing SSSD’s cache before running `date; getent passwd vgali; date`, i.e.: ```auto systemctl stop sssd rm /var/lib/sss/db/* systemctl start sssd ``` ---
**Author:** ![muralidhara](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@muralidhara](https://forums.rockylinux.org/u/muralidhara)\ **Post date:** [February 8, 2024, 1:13pm UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/7 "2024-02-08T13:13:18Z")
Enable debug\_level = 9 under the [domain/example.com], did cleared the log by executing the command systemctl stop sssd ; rm -rf /var/db/nscd/\* ; rm -rf /var/lib/sss/mc/\* ; rm -rf /var/lib/sss/db/\* ; systemctl start sssd . find the sssd\_examle.com.log ```auto (2024-02-08 18:35:44): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2024-02-08 18:35:44): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2024-02-08 18:35:44): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd (2024-02-08 18:35:44): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.nss] (2024-02-08 18:35:44): [be[example.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=vgali@example.com] (2024-02-08 18:35:44): [be[example.com]] [dp_attach_req] (0x0400): [RID#2] DP Request [Account #2]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2024-02-08 18:35:44): [be[example.com]] [dp_attach_req] (0x0400): [RID#2] Number of active DP request: 1 (2024-02-08 18:35:44): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain example.com is Active (2024-02-08 18:35:44): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain example.com is Active (2024-02-08 18:35:44): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#2] reusing cached connection (2024-02-08 18:35:44): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#2] Marking connection as not idle (2024-02-08 18:35:44): [be[example.com]] [sdap_search_user_next_base] (0x0400): [RID#2] Searching for users with base [DC=example,DC=com] (2024-02-08 18:35:44): [be[example.com]] [sdap_print_server] (0x2000): [RID#2] Searching 10.184.2.1:389 (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#2] calling ldap_search_ext with [(&(sAMAccountName=vgali)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))][DC=example,DC=com]. (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectClass] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [sAMAccountName] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [unixUserPassword] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [uidNumber] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [gidNumber] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [gecos] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [unixHomeDirectory] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [loginShell] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userPrincipalName] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [name] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [memberOf] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectGUID] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectSID] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [primaryGroupID] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [whenChanged] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [uSNChanged] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [accountExpires] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userAccountControl] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userCertificate;binary] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [mail] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [altSecurityIdentities] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_step] (0x2000): [RID#2] ldap_search_ext called, msgid = 16 (2024-02-08 18:35:44): [be[example.com]] [sdap_op_add] (0x2000): [RID#2] New operation 16 timeout 6 (2024-02-08 18:35:44): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x5654f2bdfb30], connected[1], ops[0x5654f2bc8d60], ldap[0x5654f2c7a1f0] (2024-02-08 18:35:44): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 18:35:44): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#2] Handling LDAP operation [16][server: [10.184.2.1:389] filter: [(&(sAMAccountName=vgali)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))] base: [DC=example,DC=com]] took [0.690] milliseconds. (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#2] Additional References: ldap://ForestDnsZones.example.com/DC=ForestDnsZones,DC=example,DC=com (2024-02-08 18:35:44): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x5654f2bdfb30], connected[1], ops[0x5654f2bc8d60], ldap[0x5654f2c7a1f0] (2024-02-08 18:35:44): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#2] Additional References: ldap://DomainDnsZones.example.com/DC=DomainDnsZones,DC=example,DC=com (2024-02-08 18:35:44): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x5654f2bdfb30], connected[1], ops[0x5654f2bc8d60], ldap[0x5654f2c7a1f0] (2024-02-08 18:35:44): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#2] Additional References: ldap://example.com/CN=Configuration,DC=example,DC=com (2024-02-08 18:35:44): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x5654f2bdfb30], connected[1], ops[0x5654f2bc8d60], ldap[0x5654f2c7a1f0] (2024-02-08 18:35:44): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_RESULT] (2024-02-08 18:35:44): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#2] Search result: Success(0), no errmsg set (2024-02-08 18:35:44): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#2] Operation 16 finished (2024-02-08 18:35:44): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#2] Request included referrals which were ignored. (2024-02-08 18:35:44): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#2] Ref: ldap://ForestDnsZones.example.com/DC=ForestDnsZones,DC=example,DC=com (2024-02-08 18:35:44): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#2] Ref: ldap://DomainDnsZones.example.com/DC=DomainDnsZones,DC=example,DC=com (2024-02-08 18:35:44): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#2] Ref: ldap://example.com/CN=Configuration,DC=example,DC=com (2024-02-08 18:35:44): [be[example.com]] [sdap_search_user_process] (0x0400): [RID#2] Search for users, returned 0 results. (2024-02-08 18:35:44): [be[example.com]] [sdap_search_user_process] (0x2000): [RID#2] Retrieved total 0 users (2024-02-08 18:35:44): [be[example.com]] [sdap_id_op_done] (0x4000): [RID#2] releasing operation connection (2024-02-08 18:35:44): [be[example.com]] [sdap_id_conn_data_idle] (0x4000): [RID#2] Marking connection as idle (2024-02-08 18:35:44): [be[example.com]] [sysdb_search_by_name] (0x0400): [RID#2] No such entry (2024-02-08 18:35:44): [be[example.com]] [sysdb_cache_search_groups] (0x2000): [RID#2] Search groups with filter: (&(objectCategory=group)(ghost=vgali@example.com)) (2024-02-08 18:35:44): [be[example.com]] [sysdb_cache_search_groups] (0x2000): [RID#2] No such entry (2024-02-08 18:35:44): [be[example.com]] [sysdb_delete_user] (0x0400): [RID#2] Error: 2 (No such file or directory) (2024-02-08 18:35:44): [be[example.com]] [dp_req_done] (0x0400): [RID#2] DP Request [Account #2]: Request handler finished [0]: Success (2024-02-08 18:35:44): [be[example.com]] [dp_req_done] (0x20000): [RID#2] DP Request [Account #2]: Handling request took [1.111] milliseconds. (2024-02-08 18:35:44): [be[example.com]] [_dp_req_recv] (0x0400): [RID#2] DP Request [Account #2]: Receiving request data. (2024-02-08 18:35:44): [be[example.com]] [dp_req_destructor] (0x0400): [RID#2] DP Request [Account #2]: Request removed. (2024-02-08 18:35:44): [be[example.com]] [dp_req_destructor] (0x0400): [RID#2] Number of active DP request: 0 (2024-02-08 18:35:44): [be[example.com]] [dp_req_reply_std] (0x1000): [RID#2] DP Request [Account #2]: Returning [Success]: 0,0,Success (2024-02-08 18:35:44): [be[example.com]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo: Success (2024-02-08 18:35:44): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x5654f2bdfb30], connected[1], ops[(nil)], ldap[0x5654f2c7a1f0] (2024-02-08 18:35:44): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2024-02-08 18:35:44): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. ``` ---
**Author:** ![muralidhara](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@muralidhara](https://forums.rockylinux.org/u/muralidhara)\ **Post date:** [February 8, 2024, 1:28pm UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/8 "2024-02-08T13:28:18Z")
find the sssd\_example.com.log for the user mkarigowda ```auto (2024-02-08 18:52:34): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2024-02-08 18:52:34): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. (2024-02-08 18:52:34): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd (2024-02-08 18:52:34): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.nss] (2024-02-08 18:52:34): [be[example.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=mkarigowda@example.com] (2024-02-08 18:52:34): [be[example.com]] [dp_attach_req] (0x0400): [RID#3] DP Request [Account #3]: REQ_TRACE: New request. [sssd.nss CID #2] Flags [0x0001]. (2024-02-08 18:52:34): [be[example.com]] [dp_attach_req] (0x0400): [RID#3] Number of active DP request: 1 (2024-02-08 18:52:34): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#3] Domain example.com is Active (2024-02-08 18:52:34): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#3] Domain example.com is Active (2024-02-08 18:52:34): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#3] reusing cached connection (2024-02-08 18:52:34): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#3] Marking connection as not idle (2024-02-08 18:52:34): [be[example.com]] [sdap_search_user_next_base] (0x0400): [RID#3] Searching for users with base [DC=example,DC=com] (2024-02-08 18:52:34): [be[example.com]] [sdap_print_server] (0x2000): [RID#3] Searching 10.184.2.1:389 (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#3] calling ldap_search_ext with [(&(sAMAccountName=mkarigowda)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))][DC=example,DC=com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [objectClass] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [sAMAccountName] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [unixUserPassword] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [uidNumber] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [gidNumber] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [gecos] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [unixHomeDirectory] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [loginShell] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [userPrincipalName] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [name] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [memberOf] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [objectGUID] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [objectSID] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [primaryGroupID] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [whenChanged] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [uSNChanged] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [accountExpires] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [userAccountControl] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [userCertificate;binary] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [mail] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#3] Requesting attrs: [altSecurityIdentities] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_step] (0x2000): [RID#3] ldap_search_ext called, msgid = 13 (2024-02-08 18:52:34): [be[example.com]] [sdap_op_add] (0x2000): [RID#3] New operation 13 timeout 6 (2024-02-08 18:52:34): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x560c1ed6aff0], connected[1], ops[0x560c1ee0c430], ldap[0x560c1edfcdb0] (2024-02-08 18:52:34): [be[example.com]] [sdap_process_message] (0x4000): [RID#3] Message type: [LDAP_RES_SEARCH_ENTRY] (2024-02-08 18:52:34): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#3] Handling LDAP operation [13][server: [10.184.2.1:389] filter: [(&(sAMAccountName=mkarigowda)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))] base: [DC=example,DC=com]] took [1.855] milliseconds. (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#3] OriginalDN: [CN=Muralidhara Karigowda,OU=users,OU=systems,OU=users,OU=active,OU=example,DC=example,DC=com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [objectClass] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [whenChanged] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [memberOf] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [uSNChanged] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [name] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [objectGUID] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [userAccountControl] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [primaryGroupID] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [objectSid] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [accountExpires] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [sAMAccountName] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [userPrincipalName] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [mail] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [uidNumber] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [gidNumber] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [unixHomeDirectory] (2024-02-08 18:52:34): [be[example.com]] [sdap_parse_range] (0x2000): [RID#3] No sub-attributes for [loginShell] (2024-02-08 18:52:34): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x560c1ed6aff0], connected[1], ops[0x560c1ee0c430], ldap[0x560c1edfcdb0] (2024-02-08 18:52:34): [be[example.com]] [sdap_process_message] (0x4000): [RID#3] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#3] Additional References: ldap://ForestDnsZones.example.com/DC=ForestDnsZones,DC=example,DC=com (2024-02-08 18:52:34): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x560c1ed6aff0], connected[1], ops[0x560c1ee0c430], ldap[0x560c1edfcdb0] (2024-02-08 18:52:34): [be[example.com]] [sdap_process_message] (0x4000): [RID#3] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#3] Additional References: ldap://DomainDnsZones.example.com/DC=DomainDnsZones,DC=example,DC=com (2024-02-08 18:52:34): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x560c1ed6aff0], connected[1], ops[0x560c1ee0c430], ldap[0x560c1edfcdb0] (2024-02-08 18:52:34): [be[example.com]] [sdap_process_message] (0x4000): [RID#3] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#3] Additional References: ldap://example.com/CN=Configuration,DC=example,DC=com (2024-02-08 18:52:34): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x560c1ed6aff0], connected[1], ops[0x560c1ee0c430], ldap[0x560c1edfcdb0] (2024-02-08 18:52:34): [be[example.com]] [sdap_process_message] (0x4000): [RID#3] Message type: [LDAP_RES_SEARCH_RESULT] (2024-02-08 18:52:34): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#3] Search result: Success(0), no errmsg set (2024-02-08 18:52:34): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#3] Operation 13 finished (2024-02-08 18:52:34): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#3] Request included referrals which were ignored. (2024-02-08 18:52:34): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#3] Ref: ldap://ForestDnsZones.example.com/DC=ForestDnsZones,DC=example,DC=com (2024-02-08 18:52:34): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#3] Ref: ldap://DomainDnsZones.example.com/DC=DomainDnsZones,DC=example,DC=com (2024-02-08 18:52:34): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#3] Ref: ldap://example.com/CN=Configuration,DC=example,DC=com (2024-02-08 18:52:34): [be[example.com]] [sdap_search_user_process] (0x0400): [RID#3] Search for users, returned 1 results. (2024-02-08 18:52:34): [be[example.com]] [sdap_search_user_process] (0x2000): [RID#3] Retrieved total 1 users (2024-02-08 18:52:34): [be[example.com]] [sdap_save_user] (0x0400): [RID#3] Save user (2024-02-08 18:52:34): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#3] Domain example.com is Active (2024-02-08 18:52:34): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#3] Processing object mkarigowda (2024-02-08 18:52:34): [be[example.com]] [sdap_save_user] (0x0400): [RID#3] Processing user mkarigowda@example.com (2024-02-08 18:52:34): [be[example.com]] [sdap_save_user] (0x2000): [RID#3] Adding originalDN [CN=Muralidhara Karigowda,OU=users,OU=systems,OU=users,OU=active,OU=example,DC=example,DC=com] to attributes of [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_save_user] (0x0400): [RID#3] Adding original memberOf attributes to [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] Adding original mod-Timestamp [20240201101402.0Z] to attributes of [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_save_user] (0x0400): [RID#3] Adding user principal [mkarigowda@D2-INDIA.COM] to attributes of [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] shadowLastChange is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] shadowMin is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] shadowMax is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] shadowWarning is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] shadowInactive is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] shadowExpire is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] shadowFlag is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] krbLastPwdChange is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] krbPasswordExpiration is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] pwdAttribute is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] authorizedService is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] Adding adAccountExpires [9223372036854775807] to attributes of [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] Adding adUserAccountControl [512] to attributes of [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] nsAccountLock is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] authorizedHost is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] authorizedRHost is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] ndsLoginDisabled is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] ndsLoginExpirationTime is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] ndsLoginAllowedTimeMap is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] sshPublicKey is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] authType is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] userCertificate is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] Adding mail [mkarigowda@d2.com] to attributes of [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#3] userPasskey is not available for [mkarigowda@example.com]. (2024-02-08 18:52:34): [be[example.com]] [sysdb_attrs_get_aliases] (0x2000): [RID#3] Domain is case-insensitive; will add lowercased aliases (2024-02-08 18:52:34): [be[example.com]] [sdap_save_user] (0x0400): [RID#3] Storing info for user mkarigowda@example.com (2024-02-08 18:52:34): [be[example.com]] [sysdb_search_by_name] (0x0400): [RID#3] No such entry (2024-02-08 18:52:34): [be[example.com]] [sysdb_store_user] (0x1000): [RID#3] User mkarigowda@example.com does not exist. (2024-02-08 18:52:34): [be[example.com]] [sysdb_search_user_by_uid] (0x0400): [RID#3] No such entry (2024-02-08 18:52:34): [be[example.com]] [sysdb_ldb_msg_difference] (0x2000): [RID#3] Added attr [objectSIDString] to entry [name=mkarigowda@example.com,cn=users,cn=example.com,cn=sysdb] (2024-02-08 18:52:34): [be[example.com]] [sysdb_set_entry_attr] (0x0200): [RID#3] Entry [name=mkarigowda@example.com,cn=users,cn=example.com,cn=sysdb] has set [cache, ts_cache] attrs. (2024-02-08 18:52:34): [be[example.com]] [sysdb_store_user] (0x0400): [RID#3] User "mkarigowda@example.com" has been stored (2024-02-08 18:52:34): [be[example.com]] [sdap_save_users] (0x4000): [RID#3] User 0 processed! (2024-02-08 18:52:34): [be[example.com]] [sdap_get_users_done] (0x4000): [RID#3] Saving 1 Users - Done (2024-02-08 18:52:34): [be[example.com]] [sdap_id_op_done] (0x4000): [RID#3] releasing operation connection (2024-02-08 18:52:34): [be[example.com]] [sdap_id_conn_data_idle] (0x4000): [RID#3] Marking connection as idle (2024-02-08 18:52:34): [be[example.com]] [dp_req_done] (0x0400): [RID#3] DP Request [Account #3]: Request handler finished [0]: Success (2024-02-08 18:52:34): [be[example.com]] [dp_req_done] (0x20000): [RID#3] DP Request [Account #3]: Handling request took [55.899] milliseconds. (2024-02-08 18:52:34): [be[example.com]] [_dp_req_recv] (0x0400): [RID#3] DP Request [Account #3]: Receiving request data. (2024-02-08 18:52:34): [be[example.com]] [dp_req_destructor] (0x0400): [RID#3] DP Request [Account #3]: Request removed. (2024-02-08 18:52:34): [be[example.com]] [dp_req_destructor] (0x0400): [RID#3] Number of active DP request: 0 (2024-02-08 18:52:34): [be[example.com]] [dp_req_reply_std] (0x1000): [RID#3] DP Request [Account #3]: Returning [Success]: 0,0,Success (2024-02-08 18:52:34): [be[example.com]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo: Success (2024-02-08 18:52:34): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x560c1ed6aff0], connected[1], ops[(nil)], ldap[0x560c1edfcdb0] (2024-02-08 18:52:34): [be[example.com]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (2024-02-08 18:52:34): [be[example.com]] [sbus_dispatch] (0x4000): Dispatching. ``` ---
**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\ **Post date:** [February 8, 2024, 1:39pm UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/9 "2024-02-08T13:39:37Z")
Please use the formatting tools when posting thx. Otherwise posts end up way too long instead of putting the logs or whatever in a code section. I’ve edited both your above posts, so you can see how it’s done. ---
**Author:** ![muralidhara](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@muralidhara](https://forums.rockylinux.org/u/muralidhara)\ **Post date:** [February 8, 2024, 1:44pm UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/10 "2024-02-08T13:44:43Z")
I enabled ldap\_id\_mapping = True, terminal output for getent passwd vgali [root@rocky-01 ~]# date ; getent passwd vgali ; date Thu Feb 8 07:20:52 PM IST 2024 vgali:\*:246402469:246400513:vgali:/home/vgali@example.com:/bin/bash Thu Feb 8 07:20:52 PM IST 2024 find the sssd log output for vgali . ```auto (2024-02-08 19:18:11): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd (2024-02-08 19:18:11): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.nss] (2024-02-08 19:18:11): [be[example.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=vgali@example.com] (2024-02-08 19:18:11): [be[example.com]] [dp_attach_req] (0x0400): [RID#2] DP Request [Account #2]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2024-02-08 19:18:11): [be[example.com]] [dp_attach_req] (0x0400): [RID#2] Number of active DP request: 1 (2024-02-08 19:18:11): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain example.com is Active (2024-02-08 19:18:11): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain example.com is Active (2024-02-08 19:18:11): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#2] reusing cached connection (2024-02-08 19:18:11): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#2] Marking connection as not idle (2024-02-08 19:18:11): [be[example.com]] [sdap_search_user_next_base] (0x0400): [RID#2] Searching for users with base [DC=example,DC=com] (2024-02-08 19:18:11): [be[example.com]] [sdap_print_server] (0x2000): [RID#2] Searching 10.184.2.1:389 (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#2] calling ldap_search_ext with [(&(sAMAccountName=vgali)(objectclass=user)(sAMAccountName=*)(objectSID=*))][DC=example,DC=com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectClass] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [sAMAccountName] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [unixUserPassword] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [uidNumber] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [gidNumber] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [gecos] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [unixHomeDirectory] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [loginShell] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userPrincipalName] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [name] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [memberOf] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectGUID] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectSID] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [primaryGroupID] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [whenChanged] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [uSNChanged] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [accountExpires] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userAccountControl] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userCertificate;binary] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [mail] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [altSecurityIdentities] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x2000): [RID#2] ldap_search_ext called, msgid = 7 (2024-02-08 19:18:11): [be[example.com]] [sdap_op_add] (0x2000): [RID#2] New operation 7 timeout 6 (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_ENTRY] (2024-02-08 19:18:11): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#2] Handling LDAP operation [7][server: [10.184.2.1:389] filter: [(&(sAMAccountName=vgali)(objectclass=user)(sAMAccountName=*)(objectSID=*))] base: [DC=example,DC=com]] took [1.406] milliseconds. (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#2] OriginalDN: [CN=vgali,OU=Enable_USB_DVD_Access,OU=users,OU=active,OU=example,DC=example,DC=com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [objectClass] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [name] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [objectGUID] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [primaryGroupID] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [objectSid] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [sAMAccountName] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [userPrincipalName] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#2] Additional References: ldap://ForestDnsZones.example.com/DC=ForestDnsZones,DC=example,DC=com (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd (2024-02-08 19:18:11): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.nss] (2024-02-08 19:18:11): [be[example.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=vgali@example.com] (2024-02-08 19:18:11): [be[example.com]] [dp_attach_req] (0x0400): [RID#2] DP Request [Account #2]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2024-02-08 19:18:11): [be[example.com]] [dp_attach_req] (0x0400): [RID#2] Number of active DP request: 1 (2024-02-08 19:18:11): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain example.com is Active (2024-02-08 19:18:11): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain example.com is Active (2024-02-08 19:18:11): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#2] reusing cached connection (2024-02-08 19:18:11): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#2] Marking connection as not idle (2024-02-08 19:18:11): [be[example.com]] [sdap_search_user_next_base] (0x0400): [RID#2] Searching for users with base [DC=example,DC=com] (2024-02-08 19:18:11): [be[example.com]] [sdap_print_server] (0x2000): [RID#2] Searching 10.184.2.1:389 (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#2] calling ldap_search_ext with [(&(sAMAccountName=vgali)(objectclass=user)(sAMAccountName=*)(objectSID=*))][DC=example,DC=com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectClass] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [sAMAccountName] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [unixUserPassword] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [uidNumber] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [gidNumber] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [gecos] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [unixHomeDirectory] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [loginShell] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userPrincipalName] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [name] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [memberOf] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectGUID] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectSID] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [primaryGroupID] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [whenChanged] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [uSNChanged] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [accountExpires] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userAccountControl] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userCertificate;binary] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [mail] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [altSecurityIdentities] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x2000): [RID#2] ldap_search_ext called, msgid = 7 (2024-02-08 19:18:11): [be[example.com]] [sdap_op_add] (0x2000): [RID#2] New operation 7 timeout 6 (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_ENTRY] (2024-02-08 19:18:11): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#2] Handling LDAP operation [7][server: [10.184.2.1:389] filter: [(&(sAMAccountName=vgali)(objectclass=user)(sAMAccountName=*)(objectSID=*))] base: [DC=example,DC=com]] took [1.406] milliseconds. (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#2] OriginalDN: [CN=vgali,OU=Enable_USB_DVD_Access,OU=users,OU=active,OU=example,DC=example,DC=com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [objectClass] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [name] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [objectGUID] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [primaryGroupID] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [objectSid] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [sAMAccountName] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [userPrincipalName] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#2] Additional References: ldap://ForestDnsZones.example.com/DC=ForestDnsZones,DC=example,DC=com (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getAccountInfo on /sssd (2024-02-08 19:18:11): [be[example.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.nss] (2024-02-08 19:18:11): [be[example.com]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=vgali@example.com] (2024-02-08 19:18:11): [be[example.com]] [dp_attach_req] (0x0400): [RID#2] DP Request [Account #2]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2024-02-08 19:18:11): [be[example.com]] [dp_attach_req] (0x0400): [RID#2] Number of active DP request: 1 (2024-02-08 19:18:11): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain example.com is Active (2024-02-08 19:18:11): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain example.com is Active (2024-02-08 19:18:11): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#2] reusing cached connection (2024-02-08 19:18:11): [be[example.com]] [sdap_id_conn_data_not_idle] (0x4000): [RID#2] Marking connection as not idle (2024-02-08 19:18:11): [be[example.com]] [sdap_search_user_next_base] (0x0400): [RID#2] Searching for users with base [DC=example,DC=com] (2024-02-08 19:18:11): [be[example.com]] [sdap_print_server] (0x2000): [RID#2] Searching 10.184.2.1:389 (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#2] calling ldap_search_ext with [(&(sAMAccountName=vgali)(objectclass=user)(sAMAccountName=*)(objectSID=*))][DC=example,DC=com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectClass] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [sAMAccountName] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [unixUserPassword] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [uidNumber] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [gidNumber] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [gecos] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [unixHomeDirectory] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [loginShell] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userPrincipalName] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [name] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [memberOf] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectGUID] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [objectSID] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [primaryGroupID] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [whenChanged] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [uSNChanged] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [accountExpires] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userAccountControl] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [userCertificate;binary] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [mail] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x1000): [RID#2] Requesting attrs: [altSecurityIdentities] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_step] (0x2000): [RID#2] ldap_search_ext called, msgid = 7 (2024-02-08 19:18:11): [be[example.com]] [sdap_op_add] (0x2000): [RID#2] New operation 7 timeout 6 (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_ENTRY] (2024-02-08 19:18:11): [be[example.com]] [sdap_call_op_callback] (0x20000): [RID#2] Handling LDAP operation [7][server: [10.184.2.1:389] filter: [(&(sAMAccountName=vgali)(objectclass=user)(sAMAccountName=*)(objectSID=*))] base: [DC=example,DC=com]] took [1.406] milliseconds. (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_entry] (0x1000): [RID#2] OriginalDN: [CN=vgali,OU=Enable_USB_DVD_Access,OU=users,OU=active,OU=example,DC=example,DC=com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [objectClass] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [name] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [objectGUID] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [primaryGroupID] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [objectSid] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [sAMAccountName] (2024-02-08 19:18:11): [be[example.com]] [sdap_parse_range] (0x2000): [RID#2] No sub-attributes for [userPrincipalName] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#2] Additional References: ldap://ForestDnsZones.example.com/DC=ForestDnsZones,DC=example,DC=com (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#2] Additional References: ldap://DomainDnsZones.example.com/DC=DomainDnsZones,DC=example,DC=com (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_REFERENCE] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_ext_add_references] (0x1000): [RID#2] Additional References: ldap://example.com/CN=Configuration,DC=example,DC=com (2024-02-08 19:18:11): [be[example.com]] [sdap_process_result] (0x2000): Trace: sh[0x55c4d2dcab90], connected[1], ops[0x55c4d2ed8660], ldap[0x55c4d2e6b2f0] (2024-02-08 19:18:11): [be[example.com]] [sdap_process_message] (0x4000): [RID#2] Message type: [LDAP_RES_SEARCH_RESULT] (2024-02-08 19:18:11): [be[example.com]] [sdap_get_generic_op_finished] (0x0400): [RID#2] Search result: Success(0), no errmsg set (2024-02-08 19:18:11): [be[example.com]] [sdap_op_destructor] (0x2000): [RID#2] Operation 7 finished (2024-02-08 19:18:11): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#2] Request included referrals which were ignored. (2024-02-08 19:18:11): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#2] Ref: ldap://ForestDnsZones.example.com/DC=ForestDnsZones,DC=example,DC=com (2024-02-08 19:18:11): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#2] Ref: ldap://DomainDnsZones.example.com/DC=DomainDnsZones,DC=example,DC=com (2024-02-08 19:18:11): [be[example.com]] [generic_ext_search_handler] (0x4000): [RID#2] Ref: ldap://example.com/CN=Configuration,DC=example,DC=com (2024-02-08 19:18:11): [be[example.com]] [sdap_search_user_process] (0x0400): [RID#2] Search for users, returned 1 results. (2024-02-08 19:18:11): [be[example.com]] [sdap_search_user_process] (0x2000): [RID#2] Retrieved total 1 users (2024-02-08 19:18:11): [be[example.com]] [sdap_save_user] (0x0400): [RID#2] Save user (2024-02-08 19:18:11): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain example.com is Active (2024-02-08 19:18:11): [be[example.com]] [sdap_get_primary_name] (0x0400): [RID#2] Processing object vgali (2024-02-08 19:18:11): [be[example.com]] [sdap_save_user] (0x0400): [RID#2] Processing user vgali@example.com (2024-02-08 19:18:11): [be[example.com]] [sdap_save_user] (0x1000): [RID#2] Mapping user [vgali@example.com] objectSID [S-1-5-21-1035762764-4156966091-4111642161-2469] to unix ID (2024-02-08 19:18:11): [be[example.com]] [sdap_save_user] (0x2000): [RID#2] Adding originalDN [CN=vgali,OU=Enable_USB_DVD_Access,OU=users,OU=active,OU=example,DC=example,DC=com] to attributes of [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_save_user] (0x0400): [RID#2] Original memberOf is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] original mod-Timestamp is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_save_user] (0x0400): [RID#2] Original USN value is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_save_user] (0x0400): [RID#2] Adding user principal [vgali@D2-INDIA.COM] to attributes of [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] shadowLastChange is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] shadowMin is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] shadowMax is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] shadowWarning is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] shadowInactive is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] shadowExpire is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] shadowFlag is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] krbLastPwdChange is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] krbPasswordExpiration is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] pwdAttribute is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] authorizedService is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] adAccountExpires is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] adUserAccountControl is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] nsAccountLock is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] authorizedHost is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] authorizedRHost is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] ndsLoginDisabled is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] ndsLoginExpirationTime is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] ndsLoginAllowedTimeMap is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] sshPublicKey is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] authType is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] userCertificate is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] mail is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sdap_attrs_add_ldap_attr] (0x2000): [RID#2] userPasskey is not available for [vgali@example.com]. (2024-02-08 19:18:11): [be[example.com]] [sysdb_attrs_get_aliases] (0x2000): [RID#2] Domain is case-insensitive; will add lowercased aliases (2024-02-08 19:18:11): [be[example.com]] [sdap_save_user] (0x0400): [RID#2] Storing info for user vgali@example.com (2024-02-08 19:18:11): [be[example.com]] [sysdb_search_by_name] (0x0400): [RID#2] No such entry (2024-02-08 19:18:11): [be[example.com]] [sysdb_store_user] (0x1000): [RID#2] User vgali@example.com does not exist. (2024-02-08 19:18:11): [be[example.com]] [sysdb_search_user_by_uid] (0x0400): [RID#2] No such entry (2024-02-08 19:18:11): [be[example.com]] [sysdb_ldb_msg_difference] (0x2000): [RID#2] Added attr [objectSIDString] to entry [name=vgali@example.com,cn=users,cn=example.com,cn=sysdb] (2024-02-08 19:18:11): [be[example.com]] [sysdb_set_entry_attr] (0x0200): [RID#2] Entry [name=vgali@example.com,cn=users,cn=example.com,cn=sysdb] has set [cache, ts_cache] attrs. (2024-02-08 19:18:11): [be[example.com]] [sysdb_store_user] (0x0400): [RID#2] User "vgali@example.com" has been stored (2024-02-08 19:18:11): [be[example.com]] [sdap_save_users] (0x4000): [RID#2] User 0 processed! (2024-02-08 19:18:11): [be[example.com]] [sdap_get_users_done] (0x4000): [RID#2] Saving 1 Users - Done (2024-02-08 19:18:11): [be[example.com]] [sdap_id_op_done] (0x4000): [RID#2] releasing operation connection ``` ---
**Author:** ![hortimech](https://avatars.discourse-cdn.com/v4/letter/h/b9bd4f/32.png) [@hortimech](https://forums.rockylinux.org/u/hortimech)\ **Post date:** [February 8, 2024, 4:28pm UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/11 "2024-02-08T16:28:31Z")
> [@muralidhara](#): > > Enable debug\_level = 9 under the [domain/example.com], did cleared the log by executing the command systemctl stop sssd ; rm -rf /var/db/nscd/\* ; rm -rf /var/lib/sss/mc/\* ; rm -rf /var/lib/sss/db/\* ; systemctl start sssd . > find the sssd\_examle.com.log If this was winbind (and sssd is based on winbind) I would turn off nscd, it can do very strange things. ---
**Author:** ![linde](https://avatars.discourse-cdn.com/v4/letter/l/e36b37/32.png) [@linde](https://forums.rockylinux.org/u/linde)\ **Post date:** [February 8, 2024, 5:21pm UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/12 "2024-02-08T17:21:29Z")
Based on this last `getent passwd` command and the log output, it appears that the lookup for the vgali user was successful. Is the vgali user (or any other non-Domain Admin user) able to log in now? ---
**Author:** ![dali](https://avatars.discourse-cdn.com/v4/letter/d/c68b51/32.png) [@dali](https://forums.rockylinux.org/u/dali)\ **Post date:** [February 8, 2024, 7:05pm UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/13 "2024-02-08T19:05:17Z")
If ldap\_id\_mapping is false you have to manually add [POSIX attributes](https://access.redhat.com/articles/3023821) to AD users, otherwise sssd/getent won’t see them. The same goes for groups, you need to add gidNumber to them. Not sure if it works for “Domain Users” as it is a special group i AD. ---
**Author:** ![muralidhara](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@muralidhara](https://forums.rockylinux.org/u/muralidhara)\ **Post date:** [February 9, 2024, 3:48am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/14 "2024-02-09T03:48:36Z")
Its sssd, nscd is disabled and stopped. ---
**Author:** ![muralidhara](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@muralidhara](https://forums.rockylinux.org/u/muralidhara)\ **Post date:** [February 9, 2024, 3:52am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/15 "2024-02-09T03:52:05Z")
None of non-Domain Admin user are able to login, i need to add them as domain admin wait for it sync then the user will able to login later if i remove from domain admin still he will be able to login. ---
**Author:** ![muralidhara](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@muralidhara](https://forums.rockylinux.org/u/muralidhara)\ **Post date:** [February 9, 2024, 4:00am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/16 "2024-02-09T04:00:04Z")
POSIX attributes / Unix attributes are already present for the Domain Users. ![Advgali](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/2X/8/8f5716848a4f6dd21daec5d4c29b1feecce0f9d7.png) ---
**Author:** ![linde](https://avatars.discourse-cdn.com/v4/letter/l/e36b37/32.png) [@linde](https://forums.rockylinux.org/u/linde)\ **Post date:** [February 9, 2024, 4:05am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/17 "2024-02-09T04:05:10Z")
Are there any relevant log entries in `/var/log/secure` from when a non-Domain Admin tries to log in? ---
**Author:** ![muralidhara](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@muralidhara](https://forums.rockylinux.org/u/muralidhara)\ **Post date:** [February 9, 2024, 4:24am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/18 "2024-02-09T04:24:48Z")
find the /var/log/secure for the non-domain admin. ```auto Feb 9 09:52:06 hb-rocky-01 sshd[4141604]: Invalid user roc from 10.191.1.2 port 52624 Feb 9 09:52:12 hb-rocky-01 sshd[4141604]: pam_unix(sshd:auth): check pass; user unknown Feb 9 09:52:12 hb-rocky-01 sshd[4141604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.191.1.2 Feb 9 09:52:12 hb-rocky-01 sshd[4141604]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.191.1.2 user=roc Feb 9 09:52:12 hb-rocky-01 sshd[4141604]: pam_sss(sshd:auth): received for user roc: 10 (User not known to the underlying authentication module) Feb 9 09:52:13 hb-rocky-01 sshd[4141604]: Failed password for invalid user roc from 10.191.1.2 port 52624 ssh2 ``` ---
**Author:** ![linde](https://avatars.discourse-cdn.com/v4/letter/l/e36b37/32.png) [@linde](https://forums.rockylinux.org/u/linde)\ **Post date:** [February 9, 2024, 5:21am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/19 "2024-02-09T05:21:50Z")
Based on this log output, I expect that you do not see any output from `getent passwd roc`. Is this correct? If you can’t get output from `getent passwd {username}` for a given user, then there is still a problem resolving that user and the user will not be able to log in. Below is a description of my configuration. Even if it isn’t suitable for your needs, it may be a good reference to start from just to see if you can get it working properly. * * * ## My Configuration (For Reference) In the configurations I use, we don’t have UNIX attributes stored in Active Directory. I always install the packages: `realmd PackageKit krb5-workstation adcli sssd-ad sssd-tools` I don’t make any manual modifications to `/etc/sssd/sssd.conf`. Instead, before joining the domain, I create the configuration file `/etc/sssd/conf.d/ad.example.com.conf` with the following content: ```auto [domain/ad.example.com] ldap_idmap_range_min = 800200000 ldap_idmap_range_max = 810200000 ldap_idmap_range_size = 10000000 ldap_idmap_autorid_compat = True auto_private_groups = True access_provider = simple simple_allow_groups = Linux_Users ignore_group_members = True use_fully_qualified_names = False override_homedir = /home/%u ``` (The explanation for these settings can be found in `man sssd.conf`, `man sssd-ad`, and `man sssd-ldap`.) Then I join the domain with the command `realm -v join --user={myusername} ad.example.com` ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [April 9, 2024, 5:22am UTC](https://forums.rockylinux.org/t/rocky-9-3-sssd-active-directory-domain-users/12752/20 "2024-04-09T05:22:26Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.