sssd-users October 2014

sssd-users@lists.fedorahosted.org

17 participants
17 discussions

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

Disabled enumerate and now group memberships broken
by Trey Dockendorf 31 Oct '14

31 Oct '14

I have a number of systems all on CentOS 6.5 with sssd-1.9.2 and had been using enumerate = True to support SLURM. After bringing ~300 nodes online all with enumeration enabled, I found my LDAP server was getting hit hard every 5 minutes. We've opted to disable enumeration, but since then all group membership lookups are failing. $getent group general <no output> The sssd_LDAP.log shows: (Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_connect_done] (0x0080): START TLS result: Success(0), Start TLS request accepted.Server willing to negotiate SSL. (Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_get_server_opts_from_rootdse] (0x0200): No known USN scheme is supported by this server! (Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Protocol error(2), A dereference attribute must have DN syntax (Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_deref_search_done] (0x0040): dereference processing failed [5]: Input/output error (Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_nested_group_deref_direct_done] (0x0020): Error processing direct membership [5]: Input/output error (Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_nested_done] (0x0020): Nested group processing failed: [5][Input/output error] (Thu Oct 30 18:41:03 2014) [sssd[be[LDAP]]] [sdap_id_op_done] (0x0200): communication error on cached connection, moving to next server If I re-enable enumeration, "getent group" works with just fine. If I do a "id" on a user account, their primary group just shows the GID, no group name which is breaking numerous applications. As a test I upgraded a dev system to sssd-1.11.6 based on this bug report, https://bugzilla.redhat.com/show_bug.cgi?id=1109188. However the issue persists. I've cleared caches and the result is the same. The LDAP servers are 389ds version 1.2.11.15-32.el6. Below is my sssd.conf. What else can be done to debug this or resolve this issue? Thanks, - Trey [sssd] config_file_version = 2 debug_level = 0x02F0 reconnection_retries = 3 sbus_timeout = 30 services = nss,pam,sudo,ssh domains = LDAP [nss] debug_level = 0x02F0 reconnection_retries = 3 filter_groups = root,wheel filter_users = root [pam] debug_level = 0x02F0 reconnection_retries = 3 offline_credentials_expiration = 0 [sudo] [ssh] [domain/LDAP] debug_level = 0x02F0 cache_credentials = TRUE entry_cache_timeout = 6000 enumerate = FALSE id_provider = ldap auth_provider = ldap chpass_provider = ldap access_provider = ldap sudo_provider = ldap ldap_uri = ldap://ldap01.DOMAIN,ldap://ldap02.DOMAIN ldap_search_base = <OMIT> ldap_network_timeout = 3 ldap_tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/puppet-ca.crt ldap_schema = rfc2307bis ldap_id_use_start_tls = TRUE ldap_chpass_update_last_change = TRUE ldap_group_member = uniquemember ldap_group_object_class = posixGroup ldap_group_name = cn ldap_pwd_policy = none ldap_account_expire_policy = 389ds ldap_access_order = filter,expire ldap_access_filter = (objectclass=posixaccount) ldap_sudo_search_base = ou=SUDOers,<OMIT> Thanks, - Trey

2 1

Re: [SSSD-users] Getent group not fully working
by Karich, Michael 29 Oct '14

29 Oct '14

Some more information on my ongoing issue based on the ideas suggested by Jakub. I did use realmd to initiate the keytab and join the system to the domain. When first performing the ldapsearch. I received an error that the keytab was not initialized. I tried to initialize via the command you provided, but was given an error " kinit: Keytab contains no suitable keys for V-REPO-OP-02$@AD_DOMAIN" I was able to initialize the keytab by using kinit -n UserID. Then I was able to perform an ldap search and pull all group membership as well as userid that are members of that group. Getent group "NWgroupname" still does not work. Mike Karich -----Original Message----- From: Karich, Michael Sent: Friday, October 24, 2014 8:10 AM To: 'sssd-users(a)lists.fedorahosted.org' Subject: RE: [SSSD-users] Getent group not fully working >Could you test with sssd-1.11.7? >Here is a link to yum repo >https://copr.fedoraproject.org/coprs/lslebodn/sssd-1-11/ Same results after installing 1.11.7 and rebooting. Version was confirmed via sssd --version. Mike Karich -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of sssd-users-request(a)lists.fedorahosted.org Sent: Friday, October 24, 2014 7:00 AM To: sssd-users(a)lists.fedorahosted.org Subject: sssd-users Digest, Vol 30, Issue 16 Send sssd-users mailing list submissions to sssd-users(a)lists.fedorahosted.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.fedorahosted.org/mailman/listinfo/sssd-users or, via email, send a message with subject or body 'help' to sssd-users-request(a)lists.fedorahosted.org You can reach the person managing the list at sssd-users-owner(a)lists.fedorahosted.org When replying, please edit your Subject line so it is more specific than "Re: Contents of sssd-users digest..." Today's Topics: 1. Re: sssd-users Digest, Vol 30, Issue 15 (Karich, Michael) 2. Re: sssd-users Digest, Vol 30, Issue 15 (steve) 3. Re: sssd-users Digest, Vol 30, Issue 15 (Lukas Slebodnik) ---------------------------------------------------------------------- Message: 1 Date: Thu, 23 Oct 2014 20:39:55 +0000 From: "Karich, Michael" <mkarich(a)utdallas.edu> To: "sssd-users(a)lists.fedorahosted.org" <sssd-users(a)lists.fedorahosted.org> Subject: Re: [SSSD-users] sssd-users Digest, Vol 30, Issue 15 Message-ID: <E8485E913DD2CB46BC9E4A14AA1E65C2376046BB(a)UTDEX32.campus.ad.utdallas.edu> Content-Type: text/plain; charset="utf-8" Yes I do have access to my sssd.conf I have replaced the domain with case equivalent domain [sssd] config_file_version = 2 domains = domain services = nss, pam debug_level = 10 default_domain_suffix = domain [nss] [pam] [domain/"domain"] ad_domain = domain krb5_realm = DOMAIN realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /dir/%u access_provider = ad I am using 1.11.2. Which repo will have the latest version for centos 7? When running groups as an AD user, the same groups are printed as when running ID username. Both listings are incomplete and missing the same groups. Mike Karich -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of sssd-users-request(a)lists.fedorahosted.org Sent: Thursday, October 23, 2014 3:11 PM To: sssd-users(a)lists.fedorahosted.org Subject: sssd-users Digest, Vol 30, Issue 15 Send sssd-users mailing list submissions to sssd-users(a)lists.fedorahosted.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.fedorahosted.org/mailman/listinfo/sssd-users or, via email, send a message with subject or body 'help' to sssd-users-request(a)lists.fedorahosted.org You can reach the person managing the list at sssd-users-owner(a)lists.fedorahosted.org When replying, please edit your Subject line so it is more specific than "Re: Contents of sssd-users digest..." Today's Topics: 1. Getent group not fully working (Karich, Michael) 2. Re: Getent group not fully working (steve) 3. Re: Getent group not fully working (Dmitri Pal) ---------------------------------------------------------------------- Message: 1 Date: Thu, 23 Oct 2014 18:36:27 +0000 From: "Karich, Michael" <mkarich(a)utdallas.edu> To: "sssd-users(a)lists.fedorahosted.org" <sssd-users(a)lists.fedorahosted.org> Subject: [SSSD-users] Getent group not fully working Message-ID: <E8485E913DD2CB46BC9E4A14AA1E65C237603A8E(a)UTDEX32.campus.ad.utdallas.edu> Content-Type: text/plain; charset="utf-8" Good afternoon, I have run into an issue on Cent 7 with sssd configured for AD auth. I am able to auth via AD usernames and passwords without issue and can "getent group MOSTGROUPS". But I have run into an issue where there are some groups that are not being seen / discovered / enumerated etc. ID of a validated username will display most of the groups, but there are some groups that are not listed which are also those are also the ones that fail getent group. I cannot find a pattern in what groups fail to enumerate. At first I thought it was length, but there are group names over 20 characters that succeed. EX. ID of user1: Group1, group 2, group 5 Getent group group1 Username list! Getent group "Group 2" Username list! Getent group group3 (user is a long time member of group in AD) Blank output Strace reveals that the command exited with status 2. Nothing is logged in sssd_DOMAIN.log Please let me know where to look next, thank you. Mike Karich IT Manager Center for Vital Longevity 1600 Viceroy Rd Dallas, TX 75235 mkarich(a)utdallas.edu<mailto:mkarich@utdallas.edu> P: 972-883-3745 C: 972-757-3299 CVL IT Assistance: CVLTech(a)utdallas.edu<mailto:CVLTech@utdallas.edu> -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20141023/af…> ------------------------------ Message: 2 Date: Thu, 23 Oct 2014 21:52:49 +0200 From: steve <steve(a)steve-ss.com> To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] Getent group not fully working Message-ID: <54495C91.3040803(a)steve-ss.com> Content-Type: text/plain; charset=utf-8; format=flowed On 23/10/14 20:36, Karich, Michael wrote: > Good afternoon, > > I have run into an issue on Cent 7 with sssd configured Do you have access to sssd.conf on your system? ------------------------------ Message: 3 Date: Thu, 23 Oct 2014 16:11:16 -0400 From: Dmitri Pal <dpal(a)redhat.com> To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] Getent group not fully working Message-ID: <544960E4.7030106(a)redhat.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" On 10/23/2014 02:36 PM, Karich, Michael wrote: > > Good afternoon, > > I have run into an issue on Cent 7 with sssd configured for AD auth. > I am able to auth via AD usernames and passwords without issue and can > “getent group MOSTGROUPS”. But I have run into an issue where there > are some groups that are not being seen / discovered / enumerated etc. > > ID of a validated username will display most of the groups, but there > are some groups that are not listed which are also those are also the > ones that fail getent group. I cannot find a pattern in what groups > fail to enumerate. At first I thought it was length, but there are > group names over 20 characters that succeed. > What version of SSSD? Did you get get all the right groups when user actually logs in? If this is the case than it is a known and expected behavior in 1.11.x. If you are using the latest 1.12.x you should see all groups so if you do not then this is a bug. > EX. ID of user1: > > Group1, group 2, group 5 > > Getent group group1 > > Username list! > > Getent group “Group 2” > > Username list! > > Getent group group3 (user is a long time member of group in AD) > > Blank output > > Strace reveals that the command exited with status 2. Nothing is > logged in sssd_DOMAIN.log > > Please let me know where to look next, thank you. > > *Mike Karich* > > *IT Manager* > > *Center for Vital Longevity* > > *1600 Viceroy Rd* > > *Dallas, TX 75235* > > ** > > *mkarich(a)utdallas.edu* <mailto:mkarich@utdallas.edu>** > > *P: 972-883-3745 C: 972-757-3299* > > ** > > *CVL IT Assistance: **CVLTech(a)utdallas.edu* > <mailto:CVLTech@utdallas.edu>** > > > > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/sssd-users -- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20141023/53…> ------------------------------ _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users End of sssd-users Digest, Vol 30, Issue 15 ****************************************** ------------------------------ Message: 2 Date: Thu, 23 Oct 2014 23:23:06 +0200 From: steve <steve(a)steve-ss.com> To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] sssd-users Digest, Vol 30, Issue 15 Message-ID: <544971BA.7020708(a)steve-ss.com> Content-Type: text/plain; charset=utf-8; format=flowed On 23/10/14 22:39, Karich, Michael wrote: > Yes I do have access to my sssd.conf Hi OK. login first or use 1.12.2 HTH, Steve ------------------------------ Message: 3 Date: Fri, 24 Oct 2014 00:33:16 +0200 From: Lukas Slebodnik <lslebodn(a)redhat.com> To: End-user discussions about the System Security Services Daemon <sssd-users(a)lists.fedorahosted.org> Subject: Re: [SSSD-users] sssd-users Digest, Vol 30, Issue 15 Message-ID: <20141023223315.GA14325(a)mail.corp.redhat.com> Content-Type: text/plain; charset=utf-8 On (23/10/14 20:39), Karich, Michael wrote: >Yes I do have access to my sssd.conf > >I have replaced the domain with case equivalent domain > >[sssd] > config_file_version = 2 >domains = domain >services = nss, pam > debug_level = 10 >default_domain_suffix = domain > >[nss] > >[pam] > >[domain/"domain"] >ad_domain = domain >krb5_realm = DOMAIN >realmd_tags = manages-system joined-with-samba cache_credentials = True >id_provider = ad krb5_store_password_if_offline = True default_shell = >/bin/bash ldap_id_mapping = True use_fully_qualified_names = True >fallback_homedir = /dir/%u access_provider = ad > > > >I am using 1.11.2. Which repo will have the latest version for centos 7? > Could you test with sssd-1.11.7? Here is a link to yum repo https://copr.fedoraproject.org/coprs/lslebodn/sssd-1-11/ >When running groups as an AD user, the same groups are printed as when >running ID username. Both listings are incomplete and missing the same groups. > LS ------------------------------ _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users End of sssd-users Digest, Vol 30, Issue 16 ******************************************

2 3

Can't authenticate with a different domain
by Cristian Falcas 27 Oct '14

27 Oct '14

Hello, I'm trying to login on a machine from domain2 (machine is joined in domain2) using a user from domain1, but it keeps failing. Also, using pbis I can login without problems. Users from domain2 can login successfully. Also, I can login on machines registered in domain1 using the same user. Most probably it fails because of this error: Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] Maybe someone can take a look at the attached logs and give me a hint on what is wrong? sssd says domain1 is a subdomain for domain2: (Wed Oct 15 08:42:35 2014) [sssd[pam]] [new_subdomain] (0x0400): Creating [ domain1.net] as subdomain of [domain2.net] (Wed Oct 15 08:42:35 2014) [sssd[pam]] [new_subdomain] (0x0400): Creating [ ie-aws.domain2.net] as subdomain of [domain2.net] Configuration: authconfig --enablesssd --enablesssdauth --enablemkhomedir --update --disableldaptls --enableldap --enablelocauthorize --update sssd version: 1.12.1-2.el7.centos sssd.conf: [sssd] services = nss, pam config_file_version = 2 domains = optymyze.net override_space = ^ [domain/optymyze.net] id_provider = ad auth_provider = ad access_provider = ad chpass_provider = ad dyndns_update = false create_homedir = true override_homedir = /home/%d/%u override_shell = /bin/bash timeout = 3600 [pam] timeout = 3600 [nss] timeout = 3600

2 1

Re: [SSSD-users] Getent group not fully working
by Karich, Michael 24 Oct '14

24 Oct '14

>Could you test with sssd-1.11.7? >Here is a link to yum repo >https://copr.fedoraproject.org/coprs/lslebodn/sssd-1-11/ Same results after installing 1.11.7 and rebooting. Version was confirmed via sssd --version. Mike Karich -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of sssd-users-request(a)lists.fedorahosted.org Sent: Friday, October 24, 2014 7:00 AM To: sssd-users(a)lists.fedorahosted.org Subject: sssd-users Digest, Vol 30, Issue 16 Send sssd-users mailing list submissions to sssd-users(a)lists.fedorahosted.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.fedorahosted.org/mailman/listinfo/sssd-users or, via email, send a message with subject or body 'help' to sssd-users-request(a)lists.fedorahosted.org You can reach the person managing the list at sssd-users-owner(a)lists.fedorahosted.org When replying, please edit your Subject line so it is more specific than "Re: Contents of sssd-users digest..." Today's Topics: 1. Re: sssd-users Digest, Vol 30, Issue 15 (Karich, Michael) 2. Re: sssd-users Digest, Vol 30, Issue 15 (steve) 3. Re: sssd-users Digest, Vol 30, Issue 15 (Lukas Slebodnik) ---------------------------------------------------------------------- Message: 1 Date: Thu, 23 Oct 2014 20:39:55 +0000 From: "Karich, Michael" <mkarich(a)utdallas.edu> To: "sssd-users(a)lists.fedorahosted.org" <sssd-users(a)lists.fedorahosted.org> Subject: Re: [SSSD-users] sssd-users Digest, Vol 30, Issue 15 Message-ID: <E8485E913DD2CB46BC9E4A14AA1E65C2376046BB(a)UTDEX32.campus.ad.utdallas.edu> Content-Type: text/plain; charset="utf-8" Yes I do have access to my sssd.conf I have replaced the domain with case equivalent domain [sssd] config_file_version = 2 domains = domain services = nss, pam debug_level = 10 default_domain_suffix = domain [nss] [pam] [domain/"domain"] ad_domain = domain krb5_realm = DOMAIN realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /dir/%u access_provider = ad I am using 1.11.2. Which repo will have the latest version for centos 7? When running groups as an AD user, the same groups are printed as when running ID username. Both listings are incomplete and missing the same groups. Mike Karich -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of sssd-users-request(a)lists.fedorahosted.org Sent: Thursday, October 23, 2014 3:11 PM To: sssd-users(a)lists.fedorahosted.org Subject: sssd-users Digest, Vol 30, Issue 15 Send sssd-users mailing list submissions to sssd-users(a)lists.fedorahosted.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.fedorahosted.org/mailman/listinfo/sssd-users or, via email, send a message with subject or body 'help' to sssd-users-request(a)lists.fedorahosted.org You can reach the person managing the list at sssd-users-owner(a)lists.fedorahosted.org When replying, please edit your Subject line so it is more specific than "Re: Contents of sssd-users digest..." Today's Topics: 1. Getent group not fully working (Karich, Michael) 2. Re: Getent group not fully working (steve) 3. Re: Getent group not fully working (Dmitri Pal) ---------------------------------------------------------------------- Message: 1 Date: Thu, 23 Oct 2014 18:36:27 +0000 From: "Karich, Michael" <mkarich(a)utdallas.edu> To: "sssd-users(a)lists.fedorahosted.org" <sssd-users(a)lists.fedorahosted.org> Subject: [SSSD-users] Getent group not fully working Message-ID: <E8485E913DD2CB46BC9E4A14AA1E65C237603A8E(a)UTDEX32.campus.ad.utdallas.edu> Content-Type: text/plain; charset="utf-8" Good afternoon, I have run into an issue on Cent 7 with sssd configured for AD auth. I am able to auth via AD usernames and passwords without issue and can "getent group MOSTGROUPS". But I have run into an issue where there are some groups that are not being seen / discovered / enumerated etc. ID of a validated username will display most of the groups, but there are some groups that are not listed which are also those are also the ones that fail getent group. I cannot find a pattern in what groups fail to enumerate. At first I thought it was length, but there are group names over 20 characters that succeed. EX. ID of user1: Group1, group 2, group 5 Getent group group1 Username list! Getent group "Group 2" Username list! Getent group group3 (user is a long time member of group in AD) Blank output Strace reveals that the command exited with status 2. Nothing is logged in sssd_DOMAIN.log Please let me know where to look next, thank you. Mike Karich IT Manager Center for Vital Longevity 1600 Viceroy Rd Dallas, TX 75235 mkarich(a)utdallas.edu<mailto:mkarich@utdallas.edu> P: 972-883-3745 C: 972-757-3299 CVL IT Assistance: CVLTech(a)utdallas.edu<mailto:CVLTech@utdallas.edu> -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20141023/af…> ------------------------------ Message: 2 Date: Thu, 23 Oct 2014 21:52:49 +0200 From: steve <steve(a)steve-ss.com> To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] Getent group not fully working Message-ID: <54495C91.3040803(a)steve-ss.com> Content-Type: text/plain; charset=utf-8; format=flowed On 23/10/14 20:36, Karich, Michael wrote: > Good afternoon, > > I have run into an issue on Cent 7 with sssd configured Do you have access to sssd.conf on your system? ------------------------------ Message: 3 Date: Thu, 23 Oct 2014 16:11:16 -0400 From: Dmitri Pal <dpal(a)redhat.com> To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] Getent group not fully working Message-ID: <544960E4.7030106(a)redhat.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" On 10/23/2014 02:36 PM, Karich, Michael wrote: > > Good afternoon, > > I have run into an issue on Cent 7 with sssd configured for AD auth. > I am able to auth via AD usernames and passwords without issue and can > “getent group MOSTGROUPS”. But I have run into an issue where there > are some groups that are not being seen / discovered / enumerated etc. > > ID of a validated username will display most of the groups, but there > are some groups that are not listed which are also those are also the > ones that fail getent group. I cannot find a pattern in what groups > fail to enumerate. At first I thought it was length, but there are > group names over 20 characters that succeed. > What version of SSSD? Did you get get all the right groups when user actually logs in? If this is the case than it is a known and expected behavior in 1.11.x. If you are using the latest 1.12.x you should see all groups so if you do not then this is a bug. > EX. ID of user1: > > Group1, group 2, group 5 > > Getent group group1 > > Username list! > > Getent group “Group 2” > > Username list! > > Getent group group3 (user is a long time member of group in AD) > > Blank output > > Strace reveals that the command exited with status 2. Nothing is > logged in sssd_DOMAIN.log > > Please let me know where to look next, thank you. > > *Mike Karich* > > *IT Manager* > > *Center for Vital Longevity* > > *1600 Viceroy Rd* > > *Dallas, TX 75235* > > ** > > *mkarich(a)utdallas.edu* <mailto:mkarich@utdallas.edu>** > > *P: 972-883-3745 C: 972-757-3299* > > ** > > *CVL IT Assistance: **CVLTech(a)utdallas.edu* > <mailto:CVLTech@utdallas.edu>** > > > > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/sssd-users -- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20141023/53…> ------------------------------ _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users End of sssd-users Digest, Vol 30, Issue 15 ****************************************** ------------------------------ Message: 2 Date: Thu, 23 Oct 2014 23:23:06 +0200 From: steve <steve(a)steve-ss.com> To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] sssd-users Digest, Vol 30, Issue 15 Message-ID: <544971BA.7020708(a)steve-ss.com> Content-Type: text/plain; charset=utf-8; format=flowed On 23/10/14 22:39, Karich, Michael wrote: > Yes I do have access to my sssd.conf Hi OK. login first or use 1.12.2 HTH, Steve ------------------------------ Message: 3 Date: Fri, 24 Oct 2014 00:33:16 +0200 From: Lukas Slebodnik <lslebodn(a)redhat.com> To: End-user discussions about the System Security Services Daemon <sssd-users(a)lists.fedorahosted.org> Subject: Re: [SSSD-users] sssd-users Digest, Vol 30, Issue 15 Message-ID: <20141023223315.GA14325(a)mail.corp.redhat.com> Content-Type: text/plain; charset=utf-8 On (23/10/14 20:39), Karich, Michael wrote: >Yes I do have access to my sssd.conf > >I have replaced the domain with case equivalent domain > >[sssd] > config_file_version = 2 >domains = domain >services = nss, pam > debug_level = 10 >default_domain_suffix = domain > >[nss] > >[pam] > >[domain/"domain"] >ad_domain = domain >krb5_realm = DOMAIN >realmd_tags = manages-system joined-with-samba cache_credentials = True >id_provider = ad krb5_store_password_if_offline = True default_shell = >/bin/bash ldap_id_mapping = True use_fully_qualified_names = True >fallback_homedir = /dir/%u access_provider = ad > > > >I am using 1.11.2. Which repo will have the latest version for centos 7? > Could you test with sssd-1.11.7? Here is a link to yum repo https://copr.fedoraproject.org/coprs/lslebodn/sssd-1-11/ >When running groups as an AD user, the same groups are printed as when >running ID username. Both listings are incomplete and missing the same groups. > LS ------------------------------ _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users End of sssd-users Digest, Vol 30, Issue 16 ******************************************

1 0

Re: [SSSD-users] sssd-users Digest, Vol 30, Issue 15
by Karich, Michael 23 Oct '14

23 Oct '14

Yes I do have access to my sssd.conf I have replaced the domain with case equivalent domain [sssd] config_file_version = 2 domains = domain services = nss, pam debug_level = 10 default_domain_suffix = domain [nss] [pam] [domain/"domain"] ad_domain = domain krb5_realm = DOMAIN realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /dir/%u access_provider = ad I am using 1.11.2. Which repo will have the latest version for centos 7? When running groups as an AD user, the same groups are printed as when running ID username. Both listings are incomplete and missing the same groups. Mike Karich -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of sssd-users-request(a)lists.fedorahosted.org Sent: Thursday, October 23, 2014 3:11 PM To: sssd-users(a)lists.fedorahosted.org Subject: sssd-users Digest, Vol 30, Issue 15 Send sssd-users mailing list submissions to sssd-users(a)lists.fedorahosted.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.fedorahosted.org/mailman/listinfo/sssd-users or, via email, send a message with subject or body 'help' to sssd-users-request(a)lists.fedorahosted.org You can reach the person managing the list at sssd-users-owner(a)lists.fedorahosted.org When replying, please edit your Subject line so it is more specific than "Re: Contents of sssd-users digest..." Today's Topics: 1. Getent group not fully working (Karich, Michael) 2. Re: Getent group not fully working (steve) 3. Re: Getent group not fully working (Dmitri Pal) ---------------------------------------------------------------------- Message: 1 Date: Thu, 23 Oct 2014 18:36:27 +0000 From: "Karich, Michael" <mkarich(a)utdallas.edu> To: "sssd-users(a)lists.fedorahosted.org" <sssd-users(a)lists.fedorahosted.org> Subject: [SSSD-users] Getent group not fully working Message-ID: <E8485E913DD2CB46BC9E4A14AA1E65C237603A8E(a)UTDEX32.campus.ad.utdallas.edu> Content-Type: text/plain; charset="utf-8" Good afternoon, I have run into an issue on Cent 7 with sssd configured for AD auth. I am able to auth via AD usernames and passwords without issue and can "getent group MOSTGROUPS". But I have run into an issue where there are some groups that are not being seen / discovered / enumerated etc. ID of a validated username will display most of the groups, but there are some groups that are not listed which are also those are also the ones that fail getent group. I cannot find a pattern in what groups fail to enumerate. At first I thought it was length, but there are group names over 20 characters that succeed. EX. ID of user1: Group1, group 2, group 5 Getent group group1 Username list! Getent group "Group 2" Username list! Getent group group3 (user is a long time member of group in AD) Blank output Strace reveals that the command exited with status 2. Nothing is logged in sssd_DOMAIN.log Please let me know where to look next, thank you. Mike Karich IT Manager Center for Vital Longevity 1600 Viceroy Rd Dallas, TX 75235 mkarich(a)utdallas.edu<mailto:mkarich@utdallas.edu> P: 972-883-3745 C: 972-757-3299 CVL IT Assistance: CVLTech(a)utdallas.edu<mailto:CVLTech@utdallas.edu> -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20141023/af…> ------------------------------ Message: 2 Date: Thu, 23 Oct 2014 21:52:49 +0200 From: steve <steve(a)steve-ss.com> To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] Getent group not fully working Message-ID: <54495C91.3040803(a)steve-ss.com> Content-Type: text/plain; charset=utf-8; format=flowed On 23/10/14 20:36, Karich, Michael wrote: > Good afternoon, > > I have run into an issue on Cent 7 with sssd configured Do you have access to sssd.conf on your system? ------------------------------ Message: 3 Date: Thu, 23 Oct 2014 16:11:16 -0400 From: Dmitri Pal <dpal(a)redhat.com> To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] Getent group not fully working Message-ID: <544960E4.7030106(a)redhat.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" On 10/23/2014 02:36 PM, Karich, Michael wrote: > > Good afternoon, > > I have run into an issue on Cent 7 with sssd configured for AD auth. > I am able to auth via AD usernames and passwords without issue and can > “getent group MOSTGROUPS”. But I have run into an issue where there > are some groups that are not being seen / discovered / enumerated etc. > > ID of a validated username will display most of the groups, but there > are some groups that are not listed which are also those are also the > ones that fail getent group. I cannot find a pattern in what groups > fail to enumerate. At first I thought it was length, but there are > group names over 20 characters that succeed. > What version of SSSD? Did you get get all the right groups when user actually logs in? If this is the case than it is a known and expected behavior in 1.11.x. If you are using the latest 1.12.x you should see all groups so if you do not then this is a bug. > EX. ID of user1: > > Group1, group 2, group 5 > > Getent group group1 > > Username list! > > Getent group “Group 2” > > Username list! > > Getent group group3 (user is a long time member of group in AD) > > Blank output > > Strace reveals that the command exited with status 2. Nothing is > logged in sssd_DOMAIN.log > > Please let me know where to look next, thank you. > > *Mike Karich* > > *IT Manager* > > *Center for Vital Longevity* > > *1600 Viceroy Rd* > > *Dallas, TX 75235* > > ** > > *mkarich(a)utdallas.edu* <mailto:mkarich@utdallas.edu>** > > *P: 972-883-3745 C: 972-757-3299* > > ** > > *CVL IT Assistance: **CVLTech(a)utdallas.edu* > <mailto:CVLTech@utdallas.edu>** > > > > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/sssd-users -- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20141023/53…> ------------------------------ _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users End of sssd-users Digest, Vol 30, Issue 15 ******************************************

3 2

Getent group not fully working
by Karich, Michael 23 Oct '14

23 Oct '14

Good afternoon, I have run into an issue on Cent 7 with sssd configured for AD auth. I am able to auth via AD usernames and passwords without issue and can "getent group MOSTGROUPS". But I have run into an issue where there are some groups that are not being seen / discovered / enumerated etc. ID of a validated username will display most of the groups, but there are some groups that are not listed which are also those are also the ones that fail getent group. I cannot find a pattern in what groups fail to enumerate. At first I thought it was length, but there are group names over 20 characters that succeed. EX. ID of user1: Group1, group 2, group 5 Getent group group1 Username list! Getent group "Group 2" Username list! Getent group group3 (user is a long time member of group in AD) Blank output Strace reveals that the command exited with status 2. Nothing is logged in sssd_DOMAIN.log Please let me know where to look next, thank you. Mike Karich IT Manager Center for Vital Longevity 1600 Viceroy Rd Dallas, TX 75235 mkarich(a)utdallas.edu<mailto:mkarich@utdallas.edu> P: 972-883-3745 C: 972-757-3299 CVL IT Assistance: CVLTech(a)utdallas.edu<mailto:CVLTech@utdallas.edu>

3 2

Finger $USER output changes after id $USER - sssd 1.12.1
by Joschi Brauchle 23 Oct '14

23 Oct '14

Hello, I have this strange effect: tueilnt-st-test2:/ # sss_cache -U tueilnt-st-test2:/ # finger ne96soh Login: ne96soh Name: Joschi Brauchle Directory: /nas/ei/home/ne96soh Shell: /bin/bash On since Tue Oct 21 19:15 (CEST) on pts/1, idle 0:01, from mo-brauchle.lnt.ei.tum.de Last login Tue Oct 21 19:15 (CEST) on :0 from console No Mail. No Plan. tueilnt-st-test2:/ # id ne96soh uid=3036404(ne96soh) gid=3000000(tu00000gv-0defprim) groups=3000000(tu00000gv-0defprim),3404101(tu00000gv-0maallenog),3441052(tueifeigv-0feidrshar),3372549(tueifeigv-0nasadming),3398968(tueifeigv-0mitarbei),3394214(tueilntgv-0sysadmin),3319720(tu00000gv-0maalle),3393702(tueilntgv-0staff),3394681(tueilntgv-0all) tueilnt-st-test2:/ # finger ne96soh Login: ne96soh Name: ne96soh Directory: /nas/ei/home/ne96soh Shell: /bin/sh On since Tue Oct 21 19:15 (CEST) on pts/1, idle 0:01, from mo-brauchle.lnt.ei.tum.de Last login Tue Oct 21 19:15 (CEST) on :0 from console No Mail. No Plan. Also, X login is not possible with the message "user account is disabled". I think this could possibly be related to the shell that X inquires for user ne96soh. Any suggestions? Best regards, Joschi Brauchle

2 3

Announcing SSSD 1.12.2
by Jakub Hrozek 22 Oct '14

22 Oct '14

=== SSSD 1.12.2 === The SSSD team is proud to announce the release of version 1.12.2 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora 21 and rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * Fixed a regression where the IPA provider didn't fetch User Private Groups correctly * An important bug in the GPO access control which resulted in a wrong principal being used was fixed * Several new options are available for deployments that need to restrict a certain PAM service from connecting to a certain SSSD domain. For more details, see the description of pam_trusted_users and pam_public_domains options in the sssd.conf(5) man page and the domains option in the pam_sss(8) man page. * When SSSD is acting as an IPA client in setup with trusted AD domains, it is able to return group members or full group memberships for users from trusted AD domains. Please note that this feature requires a recent (4.1 Alpha or newer) release of FreeIPA server * Suport for the 'views' feature of IPA. Please note that this feature requires a recent (4.1 Alpha or newer) release of FreeIPA server. Additionally, this feature will be improved in future versions of SSSD. == Packaging Changes == * Some unit tests depend on nss_wrapper and uid_wrapper libraries. These dependencies are optional, if the libraries are not detected during build, the tests are skipped == Documentation Changes == * New PAM responder options pam_trusted_users and pam_public_domains options * New pam_sss module option called domains * A new template expansion %U that expands into the user's User Principal Name * The default value of ldap_user_objectsid and ldap_group_objectsid changed from "Not set" to objectSID in the LDAP provider == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1021 [RFE] Add domains= option to pam_sss https://fedorahosted.org/sssd/ticket/1644 [RFE] Make SSSD capable of downloading GPO policies https://fedorahosted.org/sssd/ticket/1645 [RFE] Leverage GPO policies to define HBAC https://fedorahosted.org/sssd/ticket/2041 [RFE] User's home directories and shells are not taken from AD when there is an IPA trust with AD https://fedorahosted.org/sssd/ticket/2159 [RFE] Support initgroups for unauthenticated AD users https://fedorahosted.org/sssd/ticket/2340 [RFE] User Principal Name as a template expansion for homedir mappings https://fedorahosted.org/sssd/ticket/2375 [RFE] SSSD side of IPA user-views https://fedorahosted.org/sssd/ticket/2412 Error processing universal groups with cross-domain membership in SSSD server mode https://fedorahosted.org/sssd/ticket/2435 SSSD connection terminated after failing anonymous bind to IBM Tivoli Directory Server https://fedorahosted.org/sssd/ticket/2437 conflicting gpo policy settings not being resolved correctly https://fedorahosted.org/sssd/ticket/2442 sssd.conf man page missing subdomains_provider ad support https://fedorahosted.org/sssd/ticket/2443 Password expiration policies are not being enforced by SSSD https://fedorahosted.org/sssd/ticket/2447 AD Provider crashes when looking up the "Domain Users" group https://fedorahosted.org/sssd/ticket/2452 authconfig crashes if case_sensitive=preserving in sssd.conf https://fedorahosted.org/sssd/ticket/2453 group members returned in lowercase with case_sensitive=preserving == Detailed Changelog == Daniel Gollub (2): * sysdb: Write additional attrs in sysdb_add_user * PAM: Add domains= option to pam_sss Jakub Hrozek (22): * Updating version for the 1.12.2 release * LDAP: Always free talloc_req * LDAP: Do not clobber return value when multiple controls are returned * TESTS: Add a case-insensitive group search sysdb test * MAN: AD is allowed value of subdomains_provider * tests: Add a test for storing custom attrs with automatic ID * TESTS: Add a unit test for matching the secondary objectclass * IPA: Use GC for group lookups in server mode * AD: Add a missing break statement to the GPO code * LDAP: Do not require a dereference control to be retuned in a reply * MAN: Document the domains option of pam_sss * MONITOR: Make internal functions static * SYSDB: move sysdb_get_real_name() from sysdb.c to sysdb_search.c * BUILD: Use $(MKDIR_P) in Makefile.am * MAN: Build the sss_rpcidmapd man page conditionally * UTIL: Do not depend on monitor code * MONITOR: Remove useless memory contexts * UTIL: Move become_user outside krb5 tree * BUILD: Detect nss_wrapper and uid_wrapper during configure * TESTS: Add a test to change user IDs * UTIL: Always write capaths * Updating the translations for the 1.12.2 release Jan Engelhardt (1): * build: call AC_BUILD_AUX_DIR before anything else Lukas Slebodnik (14): * CI: Add missing debian dependency * CI: Use default config for mock build * GPO: Use argument ndg_flags instead of constant * GPO: remove unused talloc contexts * DP: Print a type as hexadecimal number in debug message. * SDAP: Suppress warning maybe-uninitialized * TOOLS: Fix warning Value stored to is never read * SDAP: Fix warning Value stored to is never read * SDAP: test return value of sysdb_search_services * PAC: Check return value of function hash_entries * IPA: Fix error handling after talloc_ber_flatten * GPO: fail if there is problem with storing gpo into sysdb * GPO: Fail if we cannot retrieve gpo from cache. * GPO: Do not use output argument if function failed Michal Zidek (5): * Add alternative objectClass to group attribute maps * Use the alternative objectclass in group maps. * sssd.api.conf: Declare case_sensitive as string * nss: Preserve case of group members * LDAP: Change defaults for ldap_user/group_objectsid Nikolai Kondrashov (11): * TESTS: Free hbac_info * TESTS: Free compiled regexes in krb5_utils-tests * TESTS: Free link paths in symlink tests * TESTS: Free retrieved sid in test_getsidbyname * CI: Preserve mock config timestamps * CI: Don't run dlopen-tests under Valgrind * CI: Add Valgrind suppression support * CI: Suppress all detected Valgrind issues * CI: Enforce Valgrind check * CI: Remove disabling of Valgrind gdb invocation * CI: Don't say Valgrind is ignored in README.md Pavel Březina (8): * sysdb_get_user_attr: use fqn for subdomain users * tests: add test for sysdb_get_user_attr with subdomain user * sss_get_domain_name: check for fq name first * tests: add test for sss_get_domain_name * Add sysdb_search_[user|group]_override_attrs_by_name * Add sysdb_get_user_attr_with_views * IFP: support views * sudo: support views Pavel Reichl (5): * Fix debug messages - trailing '.' * PAM: new options pam_trusted_users & pam_public_domains * SDAP: move deciding of tls usage into new function * SDAP: check that connection is open before bind * NSS: UPN as a template expansion for homedir mappings Stephen Gallagher (4): * UTIL: Do not change SSSD domains in get_domains_head * krb5: make get_primary() a public call * AD GPO: Fix incorrect sAMAccountName selection * AD GPO: Fix incorrect return of EACCES Sumit Bose (32): * name2sid: Check negative cache for users and groups * sysdb: sysdb_search_group_by_name should work like sysdb_search_user_by_name * IPA: add support for new extdom plugin version * pam: sub-domain authentication fix * add_v1_group_data: fix for empty members list * nss: add SSS_NSS_GETORIGBYNAME request * sss_nss_idmap: add sss_nss_getorigbyname() * sysdb: add sysdb_update_view_name() * Add sdap_deref_search_with_filter_send() * IPA: make IPA ID context available to extdom client code * IPA: add view support and get view name * views: add ipa_get_ad_override_send() * sysdb: add sysdb_store_override * sysdb: add sysdb_attrs_add_val_safe() and sysdb_attrs_add_string_safe() * sysdb: sysdb_apply_default_override * views: get overrides during user and group lookups * views: search overrides for user and group requests * confdb: add has_views and view_name to sss_domain_info * new_subdomain: copy view data from parent * sysdb: add view data to domains * sysdb: add overide lookup calls * sysdb: add sysdb_getpwnam/uid_with_views() * sysdb: add sss_view_ldb_msg_find_element/attr_as_string/uint64 * nss: add view support for getpwnam/getpwuid requests * sysdb: add sysdb_initgroups_with_views() * nss: add view support to initgroups request * sysdb: add sysdb_getgrnam_with_views and sysdb_getgrgid_with_views * nss: add view support for getgr* requests * sid2name: return name without views applied * pam: make pam responder aware if views * sysdb: add sysdb_enumpw/grent_with_views() * nss: make enumeration requests aware of views Yassir Elley (1): * AD-GPO resolve conflicting policy settings correctly

5 10

AD token groups
by Prajwal Kumar 17 Oct '14

17 Oct '14

Could you please let me know which is the lowest (minimum) sssd version on which the ldap_use_tokengroups = false configuration works against AD backend? The man pages say it was introduced in 1.12 but it seems to work in 1.11.7 as well. Does it work on lower versions 1.10 / 1.9 or is there a workaround to disable token group processing with 1.10/1.9?

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users October 2014