Im back with another ldap question. this time I rebuilt sssd and
followed this guide:
for setting up ldap authentication on my centos 6.4 system.
my firewall is off and selinux is disabled.
when i do an ldapsearch -x "cn=test.user" it returns all the correct
information, but doing id test.user returns no user.
I've attached the log files and all of the relevant files and maybe
some non relevant ones as well.
it appears as tho it is searching for the user but is simply not
finding anything. Is there an option to search for cn=test.user? and
not by uid?
any help will be much appreciated.
We have two different ldap "accounts". One is used to get user account
information and the other is used get sudo information.
Is there way to have two ldap_default_bind_dn's and ldap_default_authtok's
for each of these account configured in sssd.conf.
I'm trying to set up sssd with access_provider = ldap. I'm having a little trouble getting the ldap_access_filter working the way I want to.
The way I want to do it is to create a Resource Group in AD that contains the Unix Team group and then whichever users need access to the system. So we'd have, say:
member: cn=Unix Team,ou=Groups,…
member: cn=User A,…
member: cn=User B,…
Is there a way to craft the ldap_access_filter based on the above such that the members of Unix Team and then the two users will be allowed access?
As an ancillary question to this, I'd like some clarification of how ldap_access_filter works exactly. Is it simply that the user's DN who is trying to login needs to match a result of the query specified in the access filter line?
Senior Unix Systems Engineer
Office: (313) 373-4306
Mobile: (734) 718-8472
The realmd and SSSD development teams are happy to invite you to a Fedora
Test Day that will be held on Thursday, May 9th.
We invite you to take part in testing of the new features that will become
available in upcoming upstream releases of realmd and SSSD and would be
a part of Fedora 19. The features are mostly focused on better Active
Directory integration and to some extent easier way of joining clients to
an IPA domain using realmd.
To read more about the test day and suggested tests use the following link
The tests in particular can be previewed using this link:
Even if you do not plan on following the test cases themselves, consider
joining the test day to see if the new realmd or SSSD features are usable
and working in your environment or just to see if your current workflow
is not affected in any way by the recent changes in either SSSD or realmd.
Thank you for your help and participation!
=== SSSD 1.10 Beta 1 ===
The SSSD team is proud to announce the beta release of version 1.10 of
the System Security Services Daemon.
This beta release includes several new features, mostly targeted at better
integration with Microsoft Active Directory.
As always, the source is available from https://fedorahosted.org/sssd.
RPM packages will be made available for Fedora 19 and rawhide shortly.
The SSSD 1.10 Beta 2 release is tentatively scheduled for next week,
before the Fedora Test Day which will happen on May 9th. The Beta 2
release will contain the remaining features we finish before the Test Day.
There might be another pre-release if any of the planned features are not
ready for the test day, after this last pre-release, the SSSD will enter a
period of string-freeze and the 1.10 development will switch to bug fixing
in preparation for the 1.10 final release.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
== Highlights ==
* The Active Directory provider now includes support for Site-based
discovery. This feature allows the Active Directory clients to find the
most suitable Domain Controller to connect to.
* Support for dynamic DNS updates in the Active Directory provider. This
feature enables the clients to automatically update or refresh their DNS
records stored in the AD server.
* A new library, called libsss_nss_idmap was introduced. This library
allows the user to convert Windows Security Identifiers (SIDs) to names
and vice versa. The library also includes Python bindings.
* Setting the SELinux context on the IPA server now also works for users
coming from a trusted Active Directory domain
* Fixed a serious performance issue when enumerating large number of users
* The subdomain_homedir configuration option gained a new template expansion
%F that expands to the flat name (NetBIOS name) of the trusted AD domain
== Packaging Changes ==
* The SSSD python ConfigAPI was moved to its own noarch subpackage to
make the SSSD packaging more compliant with the Fedora packaging guidelines
* The libsss_nss_idmap library and its Python bindings are packaged in
== Tickets Fixed ==
[RFE] Replace pam status codes with sssd specific codes
[RFE] Allow setting krb5_renew_interval with a delimiter
[RFE] sssd should support DNS sites
[RFE] Improve syslog message when configuration cannot be loaded
[RFE] Subdomain homedir template should be configurable/use flatname by default
Confusing error messages for invalid sssd.conf
sss_cache doesn't support subdomains
move processing of password expiration back to PAM provider only
rewrite nested group processing to follow the tevent_req coding style
Use new interface from ding-libs ini interface
Document that SSSD domains should only be named using ASCII characters
make the authtok structure really opaque
Incorrect *.py[co] files placement
Allow usage of enterprise principals
add a call to calculated the range for a given domain SID to libsss_idmap
unused parameter in ipa_selinux handler
pidfile() may leak memory on error
potential out-of-bounds-write in sss_idmap_sid_to_dom_sid
negative return in files.c
Bad comparisons in checks found by new Coverity instance
Logically dead code in tools_util.c
document that AD provider is always case insensitive
ding-libs.dhash: uninitialized pointer read
freeipa 3.2 trusted ad user not listed in external group
coverity: dead code in sudo client
SSSD doesn't display warning for last grace login.
In IPA AD trust setup, the sssd logs throws 'sysdb_search_user_by_name failed' error when AD user tries to login via ipa client.
== Detailed Changelog ==
Abhishek Singh (3):
* cmocka unittest for find_uid added
* cmocka unittest for io added
* Fix segmentation fault in test_io.
Ariel Barria (2):
* Allow setting krb5_renew_interval with a delimiter
* Confusing error messages for invalid sssd.conf
Jakub Hrozek (38):
* Updating the version for the 1.10 beta1 release
* krb5 child: Use the correct type when processing OTP
* pidfile(): Do not leak fd on error
* Fix potential out-of-bounds write in sss_idmap_sid_to_dom_sid
* Return errno, not -1 on failure in files.c
* Check for correct variable name
* Init failover with be_res options
* Centralize resolv_init, remove resolv context list
* dyndns: Fix initializing sdap_id_ctx
* Check for the correct variables
* Allocate PAM DP request data on responder context
* LDAP: Always fail if a map can't be found
* Put the override_homedir into an included xml file
* Allow using flatname for subdomain home dir template
* Fix simple access group control in case-insensitive domains
* Make leak checks usable in tests that do not utilize check
* tests: Fix the order of key/values
* LDAP: do not invalidate pointer with realloc while processing ghost users
* Convert the simple access check to new error codes
* tests: Link the simple access tests with -ldl
* Do not keep growing event context
* Document the naming convention for SSSD domains
* Document that the AD provider is case-insensitive
* selinux: if no domain matches, make the debug message louder
* Only try to relink ghost users if we're not enumerating
* Display the last grace warning, too
* Refactor dynamic DNS updates
* Convert IPA-specific options to be back-end agnostic
* dyndns: new option dyndns_refresh_interval
* resolver: Return PTR record as string
* dyndns: New option dyndns_update_ptr
* dyndns: new option dyndns_force_tcp
* dyndns: new option dyndns_auth
* Split out the common code from timed DNS updates
* Active Directory dynamic DNS updates
* AD: Always initialize ID mapping
* Only check UPN if enterprise principals are not used
* Updating the translations for the 1.10 beta1 release
Jan Cholasta (1):
* Add exit status section to sss_ssh_* man pages
Lukas Slebodnik (5):
* LDAP: Fix value initialization warnings
* Incorrect *.py[co] files placement
* Fix krbcc dir creation issue with MIT krb5 1.11
* Default TEST_DIR to cwd, not empty string if not set explicitly
* SUDO: IPA provider
Michal Zidek (6):
* Check for waitpid failure at wrong place.
* Wrong condition after waitpid.
* sss_cache: support for subdomains
* sss_cache: Remove annoying messages
* Inform about function duplication.
* libsss_idmap: function to calculate range
Ondrej Kos (3):
* DB: Switch to new libini_config API
* CONFDB: prevent double free
* IDMAP: Fix variable initialization
Pavel Březina (18):
* resolv: add resolv_get_domain request to resolv utils
* resolv: add resolv_discover_srv request to resolv utils
* DNS sites support - SRV lookup plugin interface
* DNS sites support - SRV DNS lookup plugin
* fail over - add function to insert multiple servers to the list
* DNS sites support - replace SRV lookup code with a plugin call
* DNS sites support - use SRV DNS lookup plugin in all providers
* DNS sites support - add IPA SRV plugin
* sudo client: remove dead code
* add fo_discover_servers request
* IPA SRV plugin: use fo_discover_servers request
* IPA SRV plugin: improve debugging
* sdap: add sdap_connect_host request
* add sss_ldap_encode_ndr_uint32
* DNS sites support - add AD SRV plugin
* dns srv plugin: compare domain names case insensitive
* AD SRV plugin: check if site name is empty
* fo_discover_servers_send: don't crash when backup_domain is NULL
Simo Sorce (1):
* Further restrict become_user drop of privileges.
Sumit Bose (21):
* Fix and rename get_my_domain_data()
* Refactoring: remove duplicated code in nss responder
* Allow usage of enterprise principals
* Make IPA SELinux provider aware of subdomain users
* Add override_homedir.xml to po4a.cfg
* Remove unused TALLOC_CTX from responder_get_domain()
* responder_get_domain: do not return disabled domains
* responder_get_domain(): remove timeout calculation
* LDAP: always store SID if available
* Add secid filter to responder-dp protocol
* Add two new request types to the data-provider interface
* Add idmap context to nss context
* Add responder_get_domain_by_id()
* sysdb: add sysdb_search_object_by_sid()
* Add sss_ncache_set_sid() and sss_ncache_check_sid()
* Remove unused attribute list
* Use struct to hold different types of request parameters
* Add SID related lookups to IPA subdomains
* Add SID related calls to the NSS responder
* Add client library for SID related lookups
* Add python interface to libsss_nss_idmap
Yuri Chornoivan (1):
* Fix typos in man pages
Probably not the best list to ask this question, but I will try anyway.
Can we expect to gss-proxy in RHEL-7?
The thing is that I would like to let Linux-based dhcp server to update windows based DNS server via gss-tsig updates and hate 'chgrp dhcpd /etc/krb5.keytab' dirty hack.
I guess sssd should use gss-proxy as well.
many new features rely on library APIs and features that are only available
in recent versions of SSSD dependencies. As a result, the code often needs
#ifdefs and special branches in order to at least compile or run on RHEL5.
So far we've been doing nightly builds also for RHEL5 and fixing issues
as we were finding them. But recently we are considering dropping support
for RHEL5 -- it is causing some engineering effort and at the same time
the audience is probably very limited. If you are running super-stable
enterprise distribution, chances are you are not all that interested in
the latest and possibly very unstable SSSD version.
The proposal would be to keep building and supporting the 1.9.x branch
for RHEL5 and switch to using RHEL6 as the oldest supported release
starting from the 1.10 upstream version. Of course we would still accept
patches from any potential contributors.
Any objections against the plan?