Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")

[sumit-bose]

Description of problem:

Unable to lookup AD user from child domain. Filtering of the domains more configurable.

From sssd_$domain.log

-----
(2022-11-17 18:29:10): [be[example.com]] [dp_attach_req] (0x0400): [RID#5] DP Request [adount #5]: REQ_TRACE: New request. [sssd.nss CID #58] Flags [0x0001].
(2022-11-17 18:29:10): [be[example.com]] [dp_attach_req] (0x0400): [RID#5] Number of active DP request: 2
(2022-11-17 18:29:10): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#5] Domain example.com is Active
(2022-11-17 18:29:10): [be[example.com]] [sss_domain_get_state] (0x1000): [RID#5] Domain example.com is Active
(2022-11-17 18:29:10): [be[example.com]] [sdap_id_op_connect_step] (0x4000): [RID#5] reusing cached connection
(2022-11-17 18:29:10): [be[example.com]] [sdap_search_user_next_base] (0x0400): [RID#5] Searching for users with base [DC=example,DC=com]
(2022-11-17 18:29:10): [be[example.com]] [sdap_print_server] (0x2000): [RID#5] Searching 128.0.x.x
(2022-11-17 18:29:10): [be[example.com]] [sdap_get_generic_ext_step] (0x0400): [RID#5] calling ldap_search_ext with [(&(sAMadountName=roy)(objectclass=user)(sAMadountName=*)(objectSID=*))][DC=example,DC=com].
...
(2022-11-17 18:29:10): [be[example.com]] [sdap_ldap_connect_callback_add] (0x4000): New connection to [ldap://ad03.example.com/DC=ad03,DC=example,DC=com] with fd [21]
(2022-11-17 18:29:10): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:10): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:10): [be[example.com]] [sdap_ldap_connect_callback_add] (0x4000): New connection to [ldap://ad02.example.com/DC=adt02,DC=example,DC=com] with fd [26]
(2022-11-17 18:29:10): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:10): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:10): [be[example.com]] [sdap_ldap_connect_callback_add] (0x4000): New connection to [ldap://adT05.example.com/DC=adT05,DC=example,DC=com] with fd [27]
(2022-11-17 18:29:10): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:10): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:10): [be[example.com]] [sdap_ldap_connect_callback_add] (0x4000): New connection to [ldap://lfwc.example.com/DC=lfwc,DC=example,DC=com] with fd [28]
(2022-11-17 18:29:10): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:10): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:10): [be[example.com]] [sdap_ldap_connect_callback_add] (0x4000): New connection to [ldap://adt04.example.com/DC=adt04,DC=example,DC=com] with fd [29]
(2022-11-17 18:29:10): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:10): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:11): [be[example.com]] [sdap_ldap_connect_callback_add] (0x4000): New connection to [ldap://ladc.example.com/DC=ladc,DC=example,DC=com] with fd [30]
(2022-11-17 18:29:11): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:11): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:11): [be[example.com]] [sdap_ldap_connect_callback_add] (0x4000): New connection to [ldap://adt01.example.com/DC=adt01,DC=example,DC=com] with fd [31] <--
(2022-11-17 18:29:11): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:11): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:11): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:11): [be[example.com]] [ad_sasl_log] (0x0040): SASL: GSSAPI Error: An invalid name was supplied (Success) <--
(2022-11-17 18:29:11): [be[example.com]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] <---
(2022-11-17 18:29:11): [be[example.com]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://adt01.example.com/DC=adt01,DC=example,DC=com].
(2022-11-17 18:29:11): [be[example.com]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [31].
(2022-11-17 18:29:11): [be[example.com]] [ad_sasl_log] (0x4000): SASL: GSSAPI client step 1
(2022-11-17 18:29:11): [be[example.com]] [ad_sasl_log] (0x0040): SASL: GSSAPI Error: An invalid name was supplied (Success)
(2022-11-17 18:29:11): [be[example.com]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error]
(2022-11-17 18:29:11): [be[example.com]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://dc.example.com/DC=ladc,DC=example,DC=com].
(2022-11-17 18:29:11): [be[example.com]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [30].
----

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.
2.
3.

Actual results:

Expected results:

Additional info:

[sumit-bose]

Bugzilla Bug: https://bugzilla.redhat.com/show_bug.cgi?id=2170484

[pbrezina]

Pushed PR: #6627

• master
  • 1bf4751 - tests: fix typo in ldapi test
  • 9358a74 - ad: skip filtering if ad_enabled_domains is set