12:37 p.m.
Hello everybody,
On 19/07/17 16:57, Jelle de Jong wrote:
Hello everybody,
I been trying hard to get sssd to work on a new CentOS 7 workstation.
sssd --version
1.14.0
# working ldapsearch command and output
https://paste.fedoraproject.org/paste/L3Uv8Mg6FMuLlIHXkL5~0Q/raw
The problem is I am at a customer that has an old Windows 2008 AD server
with Unix tools and the uidNumber, gidNumber, unixHomeDirectory and
loginShell need to be used, so that my nfs shares have the correct mapping.
They used an old NIS server in the passed but it is broken and has no AD
connection any more.
I can not seem to bind to the RootDSE without using a username and
password, see the ldapsearch command, i tried converting the
"LDAP(a)wdm.local" to a cn path, but whatever i try i get a "
additional info: 80090308: LdapErr: DSID-0C0903A8, comment:
AcceptSecurityContext error, data 52e, v1db1" back.
My sssd just keeps loging: ([sssd[be[default]]] [dp_req_reply_gen_error]
(0x0080): DP Request [Subdomains #0]: Finished. Target is not supported
with this configuration.
[root@vsxtest01 ~]# cat /etc/sssd/sssd.conf
[domain/default]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://sw008.wdm.local/
ldap_search_base = ou=COMPANY,dc=wdm,dc=local
#ldap_schema = rfc2307bis
#ldap_user_home_directory = unixHomeDirectory
#ldap_tls_reqcert = allow
#ldap_id_use_start_tls = True
ldap_tls_cacertdir = /etc/openldap/cacerts
debug_level = 5
autofs_provider = ldap
#ldap_default_bind_dn = cn=LDAP,ou=Users,ou=COMPANY,dc=wdm,dc=local
ldap_default_bind_dn = LDAP(a)wdm.local
ldap_default_authtok = *secret*
ldap_default_authtok_type = password
cache_credentials = True
[sssd]
config_file_version = 2
services = autofs
domains = default
[autofs]
I have no idea how to get my user authentication working with the
correct uidNumber, gidNumber mapping.
Can somebody maybe help?
I got a working setup... I split the config between custom and standard
created settings, I do not know where I need the nss or autofs service
for but these seem to be auto created. The ldap.conf is untouched,
standard config from authconfig, the ldap_user and ldap_group all seem
to be needed to make it work.... of the entryuuid I do not now what is
does exactly. Does this look okay to try to take into production?
- name: "setup authentication sssd configs"
command: "authconfig --enablesssd --enablesssdauth --enablerfc2307bis
--enablemkhomedir --update"
- name: "setup authentication ldap configs"
command: "authconfig --enableldap --enableldapauth
--ldapserver=sw008.wdm.local --ldapbasedn=ou=COMPANY,dc=wdm,dc=local
--ldaploadcacert=http://vsxansible01.wdm.local/msadmaster.pem
--enableldaptls --update"
[domain/default]
autofs_provider = ldap
ldap_schema = rfc2307bis
ldap_search_base = ou=COMPANY,dc=wdm,dc=local
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://sw008.wdm.local/
ldap_id_use_start_tls = True
cache_credentials = True
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_user_object_class = user
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_user_principal = userPrincipalName
ldap_group_object_class = group
ldap_group_gid_number = gidNumber
ldap_user_uuid = entryuuid
ldap_group_uuid = entryuuid
enumerate = True
ldap_default_authtok_type = password
ldap_default_authtok = *secret*
ldap_default_bind_dn = LDAP(a)wdm.local
[sssd]
domains = default
services = nss, autofs
config_file_version = 2
[nss]
filter_groups = root
filter_users = root
[autofs]