You are not logged in.

#1 2013-01-11 19:56:19

nicolasavru
Member
Registered: 2010-09-17
Posts: 8

LDAP/Kerberos issue with DEs

I'm running arch on workstations with network accounts authenticating using Kerberos/LDAP and with home directories stored in AFS. After upgrading a workstation to systemd and ensuring the authentication works, logging into any DE is extremely slow and opening the logout dialog in XFCE.

Relevant (sanitized) logs (don't mind the different timestamps, the errors are the same each trial):
arch client:
error.log:
Jan 11 11:44:19 myclient polkitd[536]: nss_ldap: could not search LDAP server - Server is unavailable
Jan 11 11:44:20 myclient polkitd[536]: nss_ldap: could not search LDAP server - Server is unavailable
Jan 11 11:44:21 myclient polkitd[536]: nss_ldap: could not search LDAP server - Server is unavailable
Jan 11 11:44:23 myclient dbus-daemon: nss_ldap: could not search LDAP server - Server is unavailable
Jan 11 11:44:24 myclient dbus-daemon: nss_ldap: could not search LDAP server - Server is unavailable
Jan 11 11:44:25 myclient dbus-daemon: nss_ldap: could not search LDAP server - Server is unavailable
Jan 11 11:44:26 myclient dbus-daemon: nss_ldap: could not search LDAP server - Server is unavailable

auth.log:
Jan 11 14:26:56 myclient dbus-daemon: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (No Kerberos credentials available)
Jan 11 14:26:56 myclient polkitd[605]: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Credentials cache permissions incorrect)
Jan 11 14:26:56 myclient polkitd[605]: nss_ldap: failed to bind to LDAP server ldap://myserver.mydomain: Local error
Jan 11 14:26:56 polkitd polkitd[605]: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Credentials cache permissions incorrect)
Jan 11 14:26:56 polkitd polkitd[605]: nss_ldap: failed to bind to LDAP server ldap://myserver.mydomain: Local error
Jan 11 14:26:56 polkitd polkitd[605]: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)...

everything.log:
Jan 11 14:26:55 polkitd dbus-daemon: nss_ldap: failed to bind to LDAP server ldap://myserver.mydomain: Local error
Jan 11 14:26:55 polkitd dbus-daemon: nss_ldap: failed to bind to LDAP server ldap://myserver.mydomain: Local error
Jan 11 14:26:55 polkitd dbus-daemon: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)...
Jan 11 14:26:56 polkitd dbus-daemon: nss_ldap: failed to bind to LDAP server ldap://myserver.mydomain: Local error
Jan 11 14:26:56 polkitd dbus-daemon: nss_ldap: could not search LDAP server - Server is unavailable


server syslog:
Jan 11 14:26:59 myserver slapd[997]: conn=149656 fd=2710 ACCEPT from IP=A.B.C.D:57065 (IP=0.0.0.0:389)
Jan 11 14:26:59 myserver slapd[997]: conn=149656 op=0 UNBIND
Jan 11 14:26:59 myserver slapd[997]: conn=149656 fd=2710 closed
Jan 11 14:26:59 myserver slapd[997]: conn=149657 fd=2710 ACCEPT from IP=A.B.C.D:57066 (IP=0.0.0.0:389)
Jan 11 14:26:59 myserver slapd[997]: conn=149657 op=0 UNBIND
Jan 11 14:26:59 myserver slapd[997]: conn=149657 fd=2710 closed


Logging in via ssh or tty works fine. Window managers (xmonad, i3) work perfectly (i.e., with no delay). DEs (xfce, e17, and kde tested) work but there is a long delay while logging in (and opening the xfce logout dialog). Testing was done by starting staring the WM/DE with startx. Having dbus-launch lines in .xinitrc does not seem to make a difference in terms of speed for xmonad and i3, and the DEs were started without those lines. LightDM also takes a long time to display the greeter after the xserver has started and the cursor appears. The issue effects both network users and local users.

http://mindref.blogspot.com/2011/02/dbu … -ldap.html describes this issue and placing nscd before dbus in the daemons array in rc.conf resolved it, but adding "Requires=nscd.service" and "After=nscd.service" to dbus.service does not resolve the issue. Manually (with systemctl) stopping and starting nscd and dbus in the proper order after boot also does not resolve the issue.

Anyone have any ideas? My guess is that it has something to do with systemd/dbus/polkit because I can't think of anything else relevant that a DE environment would be doing but a WM/ssh session/tty session wouldn't be, but I haven't been able to trace the issue further.
Thanks

Offline

Board footer

Powered by FluxBB