我目前正在部署 OpenLDAP 和 SSSD 进行身份验证。当我尝试访问id存储在 LDAP 中的用户时，我得到的响应是“没有这样的用户”。
该用户已正确添加到 LDAP，我可以执行ldapsearch –ZZ并找到该用户。
我已尝试运行并在尝试用户sssd –i –d9时收到以下响应：id
[sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x418850:1:ldaptest@LDAP]
[sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [LDAP][4097][1][name=ldaptest]
[sssd[nss]] [sbus_add_timeout] (0x2000): 0x22e3960
[sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x418850:1:ldaptest@LDAP]
[sssd[be[LDAP]]] [sbus_dispatch] (0x4000): dbus conn: 0xcfac90
[sssd[be[LDAP]]] [sbus_dispatch] (0x4000): Dispatching.
[sssd[be[LDAP]]] [sbus_message_handler] (0x4000): Received SBUS method [getAccountInfo]
[sssd[be[LDAP]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit
[sssd[be[LDAP]]] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [getAccountInfo]
[sssd[be[LDAP]]] [be_get_account_info] (0x0100): Got request for [4097][1][name=ldaptest]
[sssd[be[LDAP]]] [be_get_account_info] (0x0100): Request processed. Returned 1,11,Fast reply - offline
[sssd[be[LDAP]]] [be_req_set_domain] (0x0400): Changing request domain from [LDAP] to [LDAP]
[sssd[nss]] [sbus_remove_timeout] (0x2000): 0x22e3960
[sssd[nss]] [sbus_dispatch] (0x4000): dbus conn: 0x22db230
[sssd[nss]] [sbus_dispatch] (0x4000): Dispatching.
[sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 1 errno: 11 error message: Fast reply - offline
[sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider
Error: 1, 11, Fast reply - offline
Will try to return what we have in cache
[sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x418850:1:ldaptest@LDAP]
[sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x22da6d0][20]
[sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 636 of server 'hostname' as 'not working'
[sssd[be[LDAP]]] [fo_set_port_status] (0x0400): Marking port 636 of duplicate server 'hostname' as 'not working'
[sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP'
[sssd[be[LDAP]]] [get_server_status] (0x1000): Status of server 'hostname' is 'name resolved'
[sssd[be[LDAP]]] [get_port_status] (0x1000): Port status of port 636 for server 'hostname' is 'not working'
[sssd[be[LDAP]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP'
[sssd[be[LDAP]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5
[sssd[be[LDAP]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])
[sssd[be[LDAP]]] [be_mark_offline] (0x2000): Going offline!
[sssd[be[LDAP]]] [be_ptask_create] (0x0400): Periodic task [Check if online (periodic)] was created
[sssd[be[LDAP]]] [be_ptask_schedule] (0x0400): Task [Check if online (periodic)]: scheduling task 78 seconds from now [1438098389]
[sssd[be[LDAP]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
[sssd[be[LDAP]]] [sdap_id_op_connect_done] (0x4000): notify offline to op #1
[sssd[nss]] [sbus_remove_timeout] (0x2000): 0xe6d960
[sssd[nss]] [sbus_dispatch] (0x4000): dbus conn: 0xe65230
[sssd[nss]] [sbus_dispatch] (0x4000): Dispatching.
[sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 1 errno: 11 error message: Offline
[sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider
主机名hostname解析，端口 636 肯定是打开的（已经关闭iptables并且能够telnet）
以下是我的sssd配置文件：
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[nss]
filter_users = root, ldap, named
[pam]
# LDAP domain
[domain/LDAP]
ldap_tls_reqcert = demand
auth_provider = ldap
ldap_schema = rfc2307bis
ldap_search_base = dc=test,dc=domain
ldap_group_member = uniquemember
id_provider = ldap
ldap_id_use_start_tls = true
chpass_provider = ldap
ldap_uri = ldaps://hostname:636/
ldap_chpass_uri = ldaps://hostname:636/
cache_credentials = true
ldap_tls_cacertdir = /etc/openldap/cacerts/
ldap_tls_cacert = /etc/openldap/cacerts/cacert.pem
entry_cache_timeout = 600
ldap_network_timeout = 3
ldap_access_filter = (&(object)(object))
我在 Google 上找不到答案。如能提供任何解决方案，我将不胜感激。
非常感谢。
答案1
ldap_id_use_start_tls = true
肯定是错误的。
为了将您的网络流量加密到 LDAP，您必须选择：
- 端口 636 上的旧 SSL
- 端口 389 上较新的 StartTLS（连接以普通方式开始，然后升级到 TLS）
StartTLS并且SSL互相排斥。
尝试删除有问题的行。
答案2
ldap_access_filter看起来很奇怪。试试不用它。