Running sssd with full debug output: sssd -d 0x0fffff -i, gives lots of output, and I suspect the following snippet of containing hints as to the cause of the problem:

So my guess is that there is a function load_backend_module that calls ssm_ad_id_init, which fails because sdap_idmap_add_domain cannot add my domain to the id mapping.

Let's fetch the source: for i in sssd sssd-ad sssd-ldap ; do apt-get source $i ; done and look at it. In particular, look at src/providers/ldap/sdap_idmap.c.

The function sdap_idmap_init returns “Input/output error”, which is strerror's description of EIO. That value was set by sdap_idmap_add_domain:

errno_t
sdap_idmap_add_domain(struct sdap_idmap_ctx *idmap_ctx,
                      const char *dom_name,
                      const char *dom_sid,
                      id_t slice)
{
    errno_t ret;
    struct sss_idmap_range range;
    enum idmap_error_code err;
    id_t idmap_upper;
    bool external_mapping = true;

    ret = sss_idmap_ctx_get_upper(idmap_ctx->map, &idmap_upper);
    if (ret != IDMAP_SUCCESS) {
        DEBUG(SSSDBG_CRIT_FAILURE,
              ("Failed to get upper bound of available ID range.\n"));
        ret = EIO;
        goto done;
    }

    if (dp_opt_get_bool(idmap_ctx->id_ctx->opts->basic, SDAP_ID_MAPPING)) {
        external_mapping = false;
        ret = sss_idmap_calculate_range(idmap_ctx->map, dom_sid, &slice, &range);
        if (ret != IDMAP_SUCCESS) {
            DEBUG(SSSDBG_CRIT_FAILURE,
                  ("Failed to calculate range for domain [%s]: [%d]\n", dom_name,
                   ret));
            ret = EIO;
            goto done;
        }
        DEBUG(SSSDBG_TRACE_LIBS,
              ("Adding domain [%s] as slice [%"SPRIid"]\n", dom_sid, slice));

        if (range.max > idmap_upper) {
            /* This should never happen */
            DEBUG(SSSDBG_CRIT_FAILURE,
                  ("BUG: Range maximum exceeds the global maximum: "
                   "%u > %"SPRIid"\n", range.max, idmap_upper));
            ret = EINVAL;
            goto done;
        }
    } else {
        ret = sdap_idmap_get_configured_external_range(idmap_ctx, &range);
        if (ret != EOK) {
            DEBUG(SSSDBG_OP_FAILURE,
                  ("sdap_idmap_get_configured_external_range failed.\n"));
            return ret;
        }
    }

    /* Add this domain to the map */
    err = sss_idmap_add_domain_ex(idmap_ctx->map, dom_name, dom_sid, &range,
                                  NULL, 0, external_mapping);
    if (err != IDMAP_SUCCESS) {
        DEBUG(SSSDBG_CRIT_FAILURE,
              ("Could not add domain [%s] to the map: [%d]\n",
               dom_name, err));
        ret = EIO;
        goto done;
    }

    /* If algorithmic mapping is used add this domain to the SYSDB cache so it
     * will survive reboot */
    if (!external_mapping) {
        ret = sysdb_idmap_store_mapping(idmap_ctx->id_ctx->be->domain->sysdb,
                                        idmap_ctx->id_ctx->be->domain,
                                        dom_name, dom_sid,
                                        slice);
        if (ret != EOK) {
            DEBUG(SSSDBG_OP_FAILURE, ("sysdb_idmap_store_mapping failed.\n"));
            goto done;
        }
    }

done:
    return ret;
}
    

So it returns EIO in three possible cases. From the logging, the third is the matter: sss_idmap_add_domain_ex returns failure. It returns “[11]”, of enum idmap_error_code, defined in src/lib/idmap/sss_idmap.h. That would be “IDMAP_COLLISION”. IDMAP_COLLISION is only returned from dom_check_collision, which returns that value for either of four reasons.

So we add some debug output (don't forget to #include util.h), change the changelog, install the build dependencies, and dpkg-buildpackage... Then install it: dpkg -i ../*.deb. That's a bit ugly: forgot to disable sssd, and now it hangs during update. But Ctrl-C and the installation half finishes. And we do get our output: IDMAP Collision because name and SID are inconsistent. Further debug output tells us that the domains being compared are mydomain.com and mydomain.com. Apparently, their SIDs are different. The one being added is actually set, the other, already existing one, is NULL.

Installing all the debs on every try gets hairy though. The library we're modifying is in libsss_idmap.so.0.3.0, which is in package libsss-idmap0_1.11.3-3_amd64.deb.

Now we know where in the code the problem surfaces. But not what the problem is. Should those SIDs be identical? Should only one exist? https://fedorahosted.org/sssd/wiki/DesignDocs