sssd able to login the user but failed on sudo
by Karim
Hi Team,
i have two forests both working fine in terms of authentication.
I added a user to sudoers from one of the domains and he is getting access denied.
the user is able to login with no problem, sudo is not working.
in the secure log it shows "account is expired"
in the SSSD logs it shows error
"attempting to kinit for realm xxxxxx" then
"clients credentials has been revoked"
i checked the account and it is not expired nor locked.
additionally: I have another account on the same forest which i used to join to the domain and it is working fine on both authentication and sudoers.
I also tried ldap_user_principal = no suchattribute and krb5_use_enterprise_principal = false
but the problem remains.
what could be the reason behind being able to access and later getting clients credential revoked for sudoes?
Thanks
9 years
does "ldap_access_order = host" support jokers ?
by Olivier
Hi everyone,
I have been aware on this list about "access_provider" and
"ldap_access_order" that I ignored (thank you again) and I'm know testing
couple of things.
I try to configure SSSD for host based access control (enabeling the
behavior of pam_check_host_attr) and the following works for me :
On the client side (hostname = gaia01.sandbox.example.fr), I added this to
my sssd.conf:
access_provider = ldap
ldap_access_order = host
ldap_user_authorized_host = host
I have added the objectclass hostObject to my users on the ldap side and I
see that :
- if attribute host is not set in ldap for a user, then access to
gaia01.sandbox.example.fr is refused
- if attribute host is set for a user to gaia01.sandbox.example.fr then
access is granted for that user on gaia01.sandbox.example.fr
- if attribute host is set for a user to '*' then access is granted for
that user on gaia01.sandbox.example.fr
- if attribute host is set to anything else then access to
gaia01.sandbox.example.fr is refused
-> so far so good, that's what I (almost) expected.
My problem know is that I would like to grant access to certain users to
all hosts in the sandbox space.
I tryed to set attribute host for a user to '*.sandbox.*' (I also tried
'*sandbox*') and I see that access to gaia01.sandbox.example.fr is refused
My question is : are jokers supported in the host attribute ?
And the bonus question : if not, what would you recommend to tune user
autorisations in ldap so that they can only log to all machines that
contain a specific label in there hostname (or why not all hosts that are
hosted in a specific network).
Thanks,
--
Olivier
9 years
LDAP Environment Variables lost on Ubuntu with Active Directory
by Simon
Hi,
I have configured an Ubuntu 14.04 server to authenticate against, and
use attributes from, Active Directory running on Server 2008 R2.
However, I have a seemingly odd issue whereby user environment variables
(which are initially set correctly) get lost on the second (or third)
and then subsequent logins E.g.
First login:
Creating directory '/Users/domainuser'.
domainuser@localhost:~$ pwd
/Users/domainuser
domainuser@localhost:~$ echo $HOME
/Users/domainuser
domainuser@localhost:~$ getent passwd domainuser
domainuser:*:4000:3000:DomainUser:/Users/domainuser:/bin/bash
domainuser@localhost:~$ exit
Second (or third) login:
$ pwd
/
$ echo $HOME
/
$ getent passwd domainuser
domainuser:*:4000:3000:DomainUser:/:
sssd.conf looks like this:
[sssd]
debug_level = 1
domains = example.com
config_file_version = 2
services = nss, pam, sudo
[nss]
filter_groups = root,localadmin
filter_users = root,localadmin
[domain/example.com]
# General Options
debug_level = 1
id_provider = ad
access_provider = ad
use_fully_qualified_names = false
cache_credentials = true
case_sensitive = false
# SSS-AD Options
ad_domain = example.com
# SSSD-KRB5 Options
krb5_realm = EXAMPLE.COM
realmd_tags = manages-system joined-with-samba
# SSSD-LDAP Options
ldap_schema = AD
ldap_id_mapping = false
ldap_idmap_range_min = 1000
ldap_idmap_range_max = 2145326679
ldap_search_base = dc=example,dc=com
ldap_group_search_base =
OU=Groups,DC=example,DC=com???CN=Users,DC=example,DC=com??
ldap_user_search_base = OU=Accounts,DC=example,DC=com
ldap_group_object_class = group
ldap_user_object_class = person
ldap_group_modify_timestamp = whenChanged
ldap_user_modify_timestamp = whenChanged
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = sAMAccountName
ldap_user_name = sAMAccountName
If anyone thinks they can shed any light on the matter I'd be most
grateful.
Thanks,
--
Simon
9 years
can't get dyndns_update with "id_provider = ldap" to work...
by Torgeir.Wulfsberg＠kongsberg.com
Hi!
I can't get "dyndns_update" to work when I have "ldap" as "id_provider".
Having set "debug_level = 9", I do not see any "update add/delete" entries in my sssd logfile.
Setting "ad" as "id_provider" solves this. Is this by design, or just the way it is supposed to work?
Regards,
Torgeir
________________________________
CONFIDENTIALITY
This e-mail and any attachment contain KONGSBERG information which may be proprietary, confidential or subject to export regulations, and is only meant for the intended recipient(s). Any disclosure, copying, distribution or use is prohibited, if not otherwise explicitly agreed with KONGSBERG. If received in error, please delete it immediately from your system and notify the sender properly.
9 years
