ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder
HI!
Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with
StartTLS or LDAPS using client certs?
In a project they have certs in all systems anyway (because of using puppet)
and I'd like to let the sssd instances on all the systems authenticate to the
LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid
having to set/configure passwords for each system's sssd.
Ciao, Michael.
8 years, 6 months
sssd and sudo ldap problems with IPA.
by Lance Reed
Hello,
Thanks in advance for any assistance.
This is a long post - apologizes.
I have a bit of an odd setup with IPA ipa-server-3.0.0-37.el6.x86_64
and sssd-1.9.2-129.el6_5.4.x86_64 CentOS 6.5.
My goal is to get sudo work using IPA as a source.
I setup the IPA server as normal.
Since we are using this in a cloud environment (ec2) with hosts that
may come and go quickly, we decided not to connect clients using the
ipa-client code.
Instead we have user auth working with SSSD as an LDAP provider. ( I
know this complicates all things IPA).
e.g: sssd.conf
/etc/sssd/sssd.conf
[domain/LDAP]
enumerate = true
cache_credentials = True
debug_level = 8
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_schema = IPA
ldap_uri = ldaps://ipa-1b.ec2.example.net, ldaps://ipa-1.example.net
ldap_user_search_base = dc=example,dc=net
ldap_id_use_start_tls = true
tls_reqcert = demand
ldap_tls_cacert = /etc/ipa/ca.crt
# Setting to correctly query public SSH keys from IPA server
ldap_user_ssh_public_key = ipaSshPubKey
[sssd]
services = nss, pam, ssh
config_file_version = 2
domains = LDAP
So far this is working fine, with a minor issue around password
expiration (a known issue).
NOTE: The IPA server does not keep a list of hosts since we are not
using the ipa-client / kerberos setup.
At this point I am trying to get IPA working as a sudo provider.
After reading through:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/...
and
https://www.freeipa.org/images/7/77/Freeipa30_SSSD_SUDO_Integration.pdf
I attempted to get sssd to use IPA as a sudo provider,
I added the following to sssd.conf:
[domain/LDAP]
sudo_provider = ldap
ldap_sudo_search_base = ou=sudoers,dc=example,dc=net
[sssd]
services = nss, pam, ssh, sudo
and
/etc/nsswitch.conf
sudoers: files sss
The setup did not resolve any rules, and I saw this in the logs:
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_init] (0x2000):
Initializing sudo LDAP back end
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [ldap_get_sudo_options]
(0x0400): Search base not set, trying to discover it later connecting
to the LDAP server.
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [common_parse_search_base]
(0x0100): Search base added:
[SUDO][ou=sudoers,dc=example,dc=net][SUBTREE][]
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_object_class has value sudoRole
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_name has value cn
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_command has value sudoCommand
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_host has value sudoHost
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_user has value sudoUser
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_option has value sudoOption
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_runasuser has value sudoRunAsUser
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_runasgroup has value sudoRunAsGroup
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_notbefore has value sudoNotBefore
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_notafter has value sudoNotAfter
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_order has value sudoOrder
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400):
Option ldap_sudorule_entry_usn has no value
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]]
[sdap_sudo_get_ip_addresses] (0x2000): Found IP address: 10.0.1.105 in
network 10.0.1.0/24
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]]
[sdap_sudo_get_ip_addresses] (0x2000): Found IP address:
fe80::5054:ff:fe7b:abae in network fe80::/64
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]]
[sdap_sudo_get_hostnames_send] (0x2000): Found fqdn:
lreed-sssd02.example.net
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]]
[sdap_sudo_get_hostnames_send] (0x2000): Found hostname: lreed-sssd02
(Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]]
[sdap_sudo_schedule_refresh] (0x0400): Full refresh scheduled at:
1409237202
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_sudo_full_refresh_send] (0x0400): Issuing a full refresh of sudo
rules
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_sudo_refresh_connect_done] (0x0400): SUDO LDAP connection
successful
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_sudo_load_sudoers_next_base] (0x0400): Searching for sudo rules
with base [ou=sudoers,dc=example,dc=net]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=lreed-sssd02.example.net)(sudoHost=lreed-sssd02)(sudoHost=10.0.1.105)(sudoHost=10.0.1.0/24)(sudoHost=fe80::5054:ff:fe7b:abae)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*\\*)(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))][ou=sudoers,dc=example,dc=net].
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoCommand]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoHost]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoUser]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoOption]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[sudoRunAsUser]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[sudoRunAsGroup]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[sudoNotBefore]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoNotAfter]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoOrder]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_sudo_load_sudoers_process] (0x0400): Receiving sudo rules with
base [ou=sudoers,dc=example,dc=net]
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_sudo_load_sudoers_done] (0x0400): Received 0 rules
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sysdb_sudo_purge_byfilter] (0x0400): No rules matched
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_sudo_load_sudoers_done] (0x0400): Sudoers is successfuly stored
in cache
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_sudo_full_refresh_done] (0x0400): Successful full refresh of
sudo rules
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_sudo_schedule_refresh] (0x0400): Full refresh scheduled at:
1409258802
(Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]]
[sdap_sudo_schedule_refresh] (0x0400): Smart refresh scheduled at:
1409238102
It seems “ Received 0 rules” means that IPA is note sending the full
LDAP entries with sudo rules.
I confirmed this by doing an ldap search using an authenticated user
and could see them.
I have since setup sudo-ldap.conf with an authenticated user.
This seems to be working, however it seems a bit kludgy (I admit my
entire setup is kludgy).
Question #1 is that since this is going through sudo-ldap, sssd is not
caching any of these rules.
Is there a way to make sssd call sudo-ldap instead of setting it in
nsswitch.conf: sudoers: files ldap vs sudoers: files sss ?
It does not look like it but I may have something wrong.
Question #2 is around hostname and sudo rules.
Since we don’t have the hostnames in IPA by default, I can’t easily
(AFAIK) add them to sudo rules.
I can do rules for “ANY HOST” or I can add “external hosts”
With file based sudo rules it is possible to use “wildcard”
characters” for example with hostname to do “*-dev” and control rules
thusly.
The IPA web GUI does not seem to allow such rules.
If I have to add each hostname this will become a possible show stopper.
Thanks very much for any ideas on these problems.
9 years
problem with sssd using AD on Windows server 202R2
by Kristjan Elias
Hi all,
I have been having some trouble lately with our setup of sssd what i will
try to describe for you now.
For the past year we have been using sssd to authenticate our RHEL6 local
users from Corporate MS AD.
This has been working without any problems so far.
Last week the last of our DC AD servers were upgraded to Windows server
2012R2 and now the problems started.
Firstly AD performance enhancements were lost.
Snippet from logs:
(Wed Aug 20 12:21:17 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility
level to [5]
(Wed Aug 20 14:34:38 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility
level to [5]
(Wed Aug 20 15:22:52 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility
level to [5]
(Wed Aug 20 16:03:46 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility
level to [5]
(Wed Aug 20 16:24:53 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility
level to [5]
(Wed Aug 20 16:49:04 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility
level to [5]
(Wed Aug 20 17:45:55 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility
level to [5]
(Wed Aug 20 18:05:01 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility
level to [5]
(Thu Aug 21 02:20:38 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD
compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 04:43:38 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD
compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 10:27:18 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD
compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 10:32:27 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD
compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 10:52:46 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD
compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 16:38:27 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD
compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 17:08:06 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD
compatibility level. Continuing without AD performance enhancements
(Thu Aug 21 17:41:15 2014) [sssd[be[MS_AD]]]
[sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD
compatibility level. Continuing without AD performance enhancements
For this i filed a bug:
https://fedorahosted.org/sssd/ticket/2418
Secondly when running without AD performance enhancements all logins fail
when going through the users parent groups.
This error disables the AD login for my RHEL servers.
Here are the failure points in sssd log for 3 different users:
>From my login attempt:
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name]
(0x0400): No such entry
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups]
(0x1000): Group #34 [SKYPEDWETL4] is not cached, need to add a fake entry
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb
transaction (nesting: 2)
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups]
(0x1000): Mapping group [FTE_europe_2] objectSID to unix ID
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str]
(0x0080): No [objectSID] attribute while id-mapping. [0][Success]
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb
transaction (nesting: 2)
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store]
(0x0400): Could not add incomplete groups [2]: No such file or directory
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb
transaction (nesting: 1)
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups]
(0x0080): Could not save groups [2]: No such file or directory
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done]
(0x0080): Could not save groups memberships [2](Thu Aug 28 13:59:04 2014)
[sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0)
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done]
(0x4000): Initgroups done
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done]
(0x4000): Error in initgroups: [2][No such file or directory]
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000):
releasing operation connection
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_process_result]
(0x2000): Trace: sh[0x23dfc50], connected[1], ops[(nil)], ldap[0x23dead0]
(Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_process_result]
(0x2000): Trace: ldap_result found nothing!
My colleague login attempt:
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name]
(0x0400): No such entry
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups]
(0x1000): Group #32 [SKYPEDWETL4] is not cached, need to add a fake entry
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb
transaction (nesting: 2)
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups]
(0x1000): Mapping group [SKYPE_ES_BI_FTE] objectSID to unix ID
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str]
(0x0080): No [objectSID] attribute while id-mapping. [0][Success]
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb
transaction (nesting: 2)
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store]
(0x0400): Could not add incomplete groups [2]: No such file or directory
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb
transaction (nesting: 1)
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups]
(0x0080): Could not save groups [2]: No such file or directory
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done]
(0x0080): Could not save groups memberships [2](Thu Aug 28 15:22:11 2014)
[sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0)
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done]
(0x4000): Initgroups done
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done]
(0x4000): Error in initgroups: [2][No such file or directory]
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000):
releasing operation connection
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_process_result]
(0x2000): Trace: sh[0x23dff60], connected[1], ops[(nil)], ldap[0x23de070]
(Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_process_result]
(0x2000): Trace: ldap_result found nothing!
Another collegue:
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name]
(0x0400): No such entry
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups]
(0x1000): Group #34 [SKYPEDW_FILESHARE_TEST_TPUM_RO] is not cached, need to
add a fake entry
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb
transaction (nesting: 2)
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups]
(0x1000): Mapping group [SKYPE_ES_BI_FTE] objectSID to unix ID
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str]
(0x0080): No [objectSID] attribute while id-mapping. [0][Success]
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb
transaction (nesting: 2)
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store]
(0x0400): Could not add incomplete groups [2]: No such file or directory
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb
transaction (nesting: 1)
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups]
(0x0080): Could not save groups [2]: No such file or directory
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done]
(0x0080): Could not save groups memberships [2](Thu Aug 28 15:31:57 2014)
[sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0)
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done]
(0x4000): Initgroups done
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done]
(0x4000): Error in initgroups: [2][No such file or directory]
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000):
releasing operation connection
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_process_result]
(0x2000): Trace: sh[0x23dff60], connected[1], ops[(nil)], ldap[0x23de070]
(Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_process_result]
(0x2000): Trace: ldap_result found nothing!
My sssd.conf looks like this:
##########################################################
[sssd]
domains = MS_AD
services = nss,pam
config_file_version = 2
[nss]
filter_users = root,etl,gpadmin,nws
filter_groups = root,etl,gpadmin,nws
default_shell = /bin/bash
[pam]
reconnection_retries = 3
offline_credentials_expiration = 1
offline_failed_login_attempts = 1
[domain/MS_AD]
description = LDAP domain with MS AD server
debug_level = 9
# caching credentials
enumerate = false
cache_credentials = false
min_id = 1000
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_tls_reqcert = never
ldap_id_mapping = True
ldap_schema = ad
ldap_idmap_range_min = 10000
ldap_idmap_range_max = 2000100000
ldap_idmap_range_size = 20000000
ldap_uri = ldap://adserveraddress/
ldap_search_base = OU=UserAccounts,DC=something,DC=something
,DC=something,DC=com
ldap_default_bind_dn = CN=Bind User Name,OU=UserAccounts,DC=something,DC=
something,DC=something,DC=com
ldap_default_authtok_type = password
ldap_default_authtok = passwordgoeshere
ldap_user_object_class = user
ldap_group_object_class = group
ldap_user_name = sAMAccountName
ldap_user_objectsid = objectSid
ldap_group_objectsid = objectGUID
ldap_user_search_filter = memberOf=CN=SKYPEDWETL4,OU=UserAccounts,DC=
something,DC=something,DC=something,DC=com
override_homedir = /home/%u
# performance
ldap_disable_referrals = true
##########################################################
Have any of you had experiences with errors like this?
Many thanks for your attention!
Thanks,
Kristjan Elias
9 years
sssd with ad backend, pam problems
by Stefan Schäfer
Hello list,
this is my first try here.
I've a problem with a sssd_ad setup with a samba 4 ad domain.
Samba domain is created with rfc2307 scheme. sssd works, getent passwd
shows users and groups with UNIX-attributes from the ad, but login is
impossible.
The setup is based on openSUSE 13.1 with sssd updated to version 1.12
and the sernet samba packages version 4.1.11.
My sssd configuration:
--------------------------------------------------
[sssd]
services = nss,pam
config_file_version = 2
domains = invis-ad.loc
debug_level = 5
[nss]
[pam]
[domain/invis-ad.loc]
# Using id_provider=ad sets the best defaults on its own
id_provider = ad
# In sssd, the default access provider is always 'permit'. The AD access
# provider by default checks for account expiration
access_provider = ad
# Authentication
auth_provider = ad
# Uncomment to use POSIX attributes on the server
ldap_id_mapping = false
# Uncomment if the client machine hostname doesn't match the computer
object on the DC.
ad_hostname = invisad.invis-ad.loc
# Uncomment if DNS SRV resolution is not working
ad_server = invisad.invis-ad.loc
# Uncomment if the domain section is named differently than your Samba
domain
ad_domain = invis-ad.loc
# Enumeration is discouraged for performance reasons.
enumerate = true
---------------------------------------------------------------------------------------------------------------------------------
nsswitch.conf
....
passwd compat sss
group compat sss
.....
----------------------------------------------------------------------------------------------------------------------
getent passwd:
....
hbecker:*:10000:10000:Heinz Becker:/home/hbecker:/bin/bash
This is exactly what is stored in the ad.
The pam configuration:
common-auth
------------------------------------------------------------------------------------------------------------------
#%PAM-1.0
auth required pam_env.so
auth sufficient pam_unix.so try_first_pass
auth sufficient pam_sss.so use_first_pass
common-account
-------------------------------------------------------------------------------------------------------------------
#%PAM-1.0
account requisite pam_unix.so try_first_pass
account sufficient pam_localuser.so
account [default=bad success=ok user_unknown=ignore] pam_sss.so
common-password
-------------------------------------------------------------------------------------------------------------------
password requisite pam_cracklib.so
password sufficient pam_unix.so use_authtok nullok
try_first_pass
password sufficient pam_sss.so use_authtok
common-session
--------------------------------------------------------------------------------------------------------------------
#%PAM-1.0
session required pam_limits.so
session required pam_unix.so try_first_pass
session optional pam_sss.so
session optional pam_umask.so
session optional pam_systemd.so
session optional pam_env.so
---------------------------------------------------------------------------------------------------------------------
Here the logs from different login tries:
1. non-existing user
2014-08-28T15:52:29.560167+02:00 invisad login: pam_unix(login:auth):
check pass; user unknown
2014-08-28T15:52:29.560490+02:00 invisad login: pam_unix(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost=
2014-08-28T15:52:29.567475+02:00 invisad login: pam_sss(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser=
rhost= user=oierwe
2014-08-28T15:52:29.569417+02:00 invisad login: pam_sss(login:auth):
received for user oierwe: 10 (User not known to the underlying
authentication module)
2014-08-28T15:52:29.572497+02:00 invisad login: pam_unix(login:account):
could not identify user (from getpwnam(oierwe))
2014-08-28T15:52:29.573783+02:00 invisad login: User not known to the
underlying authentication module
seems to be ok.
2. existing user, wrong password
2014-08-28T15:53:33.988971+02:00 invisad login: pam_unix(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser=
rhost= user=hbecker
2014-08-28T15:53:34.090927+02:00 invisad [sssd[krb5_child[16213]]]: #020
2014-08-28T15:53:34.101970+02:00 invisad login: pam_sss(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser=
rhost= user=hbecker
2014-08-28T15:53:34.103406+02:00 invisad login: pam_sss(login:auth):
received for user hbecker: 17 (Failure setting user credentials)
2014-08-28T15:53:34.104581+02:00 invisad login: pam_sss(login:account):
Access denied for user hbecker: 4 (System error)
2014-08-28T15:53:34.105607+02:00 invisad login: System error
seems to be ok.
3. existing user, correct password:
2014-08-28T15:54:39.661506+02:00 invisad login: pam_unix(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser=
rhost= user=hbecker
2014-08-28T15:54:39.780648+02:00 invisad [sssd[krb5_child[16218]]]: #020
2014-08-28T15:54:39.791159+02:00 invisad login: pam_sss(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser=
rhost= user=hbecker
2014-08-28T15:54:39.793320+02:00 invisad login: pam_sss(login:auth):
received for user hbecker: 4 (System error)
2014-08-28T15:54:39.795032+02:00 invisad login: pam_sss(login:account):
Access denied for user hbecker: 4 (System error)
2014-08-28T15:54:39.796398+02:00 invisad login: System error
2 times "system error", definitely not the expected result.
Any ideas?
With hope for help, regards
Stefan
--
www.invis-server.org
Stefan Schäfer
Ludwigstr. 1-3
63679 Schotten
9 years
A prototype of merged domains ("views")
by Nordgren, Bryce L -FS
Over the past month, I rearranged my local systems for our collaboration environment. The essence of the work is to combine employee identities (defined in AD) with identities for external users (defined in FreeIPA), massage them so that they look the same, and export them to every posix desktop and web application I support.
Defining cross-domain posix groups is included, and was successfully performed, but sssd doesn't have a vocabulary to describe a merged domain (one identity provider, multiple auth providers). Still trying to figure out if I can force this to work somehow.
The activity may shine a light on some of the things "views" might be required to do.
http://www.freeipa.org/page/V4/Use_Case_for_Views:_Collaboration
Enjoy,
Bryce
This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.
9 years
Re: [SSSD-users] Fwd: sssd auth issue on centos 5.10
by Lukas Slebodnik
On (26/08/14 10:14), Daniel Jung wrote:
>trying again..
>
>---------- Forwarded message ----------
>From: Daniel Jung <mimianddaniel(a)gmail.com>
>Date: Tue, Aug 26, 2014 at 10:13 AM
>Subject: Re: [SSSD-users] sssd auth issue on centos 5.10
>To: Jakub Hrozek <jhrozek(a)redhat.com>, islebodn(a)redhat.com
>
>
>Hi Lukas, or Jakub,
>
>Don't mean to be pushy but do you guys have any idea why I would need to do
>this to make TLS work on centos 5.6 and up ? I do appreciate that you guys
^^^^^^^^^^
you should use centos 5.10
>are helping out with this as centos doesnt fall under supported contract.
>
>Cheers
I thought your problem has alredy been fixed [1].
I tried to test default version of sssd on centos 5.10 and it works with
FreeIPA server (389-ds). sssd-1.9-6 from copr repo works as well.
It seems that you have problem with certificate. Unfortunately, I am not able
to help you with this part of configuration.
Try to reply also to the sssd-users in future.
LS
[1] https://lists.fedorahosted.org/pipermail/sssd-users/2014-August/002117.html
[2] https://copr.fedoraproject.org/coprs/sgallagh/sssd-1.9-rhel5/
9 years
Re: [SSSD-users] Fwd: sssd auth issue on centos 5.10
by Lukas Slebodnik
On (27/08/14 00:53), Daniel Jung wrote:
>Hi Lukas,
>
>Yes it does work after recompling nss with libnsspem and upgrading openldap
>lib. I do agree that 5.6 should really be upgraded .
>
>I had tested the cert using openssl s_client and ldapsearch -ZZ and both
>worked fine. However, sssd didnt work. Curious did you compile SSSD to use
>openssl instead of nss ?
>
I did not recompile anything. It means libnss3.so was used.
LS
9 years
Same user name and group name in AD
by Andre Pitanga
Hi list-
I'm working on a project using Active Directory 2008 R2 with Identity Management for UNIX service to provide authentication and identity for Linux users via sssd.
Using this setup, is it possible to have the Linux username and group name be the same (e.g. user apache, group apache)? I've learned that the sAMAccountName attribute must be unique across the domain but I'm not sure if sssd uses this attribute to "translate" the UID and GID to names in Linux. Hope this makes sense!
Our sssd.conf is:
[sssd]
config_file_version = 2
debug_level = 0
domains = example.com
services = nss, pam
[domain/example.com]
id_provider = ad
access_provider = ad
# We rely on UNIX extended attributes in AD
ldap_id_mapping = false
enumerate = true
--
Andre Pitanga RHCE 100-077-478
(917) 745-6256 andre.pitanga(a)redhat.com
Red Hat, Inc. Red Hat Consulting
9 years
problem sudo with centos 6.5
by alireza baghery
hi
i integrated AD windows 208 R2 with IPA server (centos 6.5)
i write a sudo policy and access for specified user and host with allow any
command.
user can execute sudo in centos 7 but when user loggin on centos 6.5 can
not execute sudo and get error below
user@AD is not in sudoers file.
i write email to IPA guys but they tell there is a bug in 6.5 around sudo
and AD users.
i can not migrate to centOS 7.please tell me how to solve this problem.
i configure /etc/nsswitch.conf --sudoers: file sss
/etc/sss/sss.conf----service nss, pam,ssh,sudo
/etc/sysconfig/network ----- NISDOMAIN=ad.com
thanks
9 years
Command in ~/.ssh/authorized_keys not triggered
by XuQing Tan
Hi, folks
I have successfully setup sssd that the project members can login with
their LDAP credentials.
we also have gitlab installed in the same server, gitlab relies on the SSH
trigger (command="..." in authorized_keys file) for git ssh auth.
but the problem is I can't get git ssh auth login success because the
gitlab-shell comamnd not triggered:
cat ~/.ssh/authorized_keys
command="*date >> a.log;* /opt/git/gitlab-shell/bin/gitlab-shell
key-2",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty
ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEAsIDug9GByMA0KWakMxt2jJTKhR4Rr53zA3iIGNyI5FFszppaAaKLyEjwi46IcPD6247eiudhNkptqAk5Ao71+iydbkuT882F+IEzgD6f4nl2fBqWyZPN/AtG8ojnQJWVOwN2W02IPgXYx+Kpbg9LAk2ac8nW/JK9A90X8+BmCcdWJzjXzoXp2RsOPeofcXcAyjr5vhHP4ES1xxC+jZ4UcpCbOLhIC1EwHGZk1Kwc1WV7IeZBd0tjjuJs1q9zDzAKNFG93U9cVZ6/92N46TNgHRcp+BRuYpGO/vK1sn2Or3x/hq/ruvjGpes+kFQ35VwSAA2DncPV0CPfn9opUXkcXw==
jenkins-ci(a)example.com
i added "date >> a.log" in front of the gitlab-shell, the expect result is
~/a.log should be generated and datetime are logged in the file.
(i test this on a normal server, which means without SSSD setup, it worked
as expected)
but on the SSSD enabled server, i did not see ~/a.log created, that means
the command not triggered.
so do you have any clue why the command not triggered?
let me know if need to provide more info, like conf file, etc.
Thanks & Best Regards!
///
(. .)
--------ooO--(_)--Ooo--------
| Nick Tan |
------------------------------------
9 years
