On Tue, 2011-05-31 at 13:58 +0000, Ethan Bonick wrote:
I am having trouble getting sssd to work properly with LDAP. I am using kerberos for passwords and LDAP for identification. I have everything working on Ubuntu and CENTOS5 clients not using SSSD so I know it works.
Kerberos works just fine and I can get a ticket. LDAP returns nothing, debug logs aren't helping me. I have included a copy of my config file. We are not using certs on ldap and it shouldn't be required since I am using kerberos for authentication.
Thanks, Ethan
[sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam domains = default
[nss] filter_groups = root filter_users = root, nimda reconnection_retries = 3
[pam] reconnection_retries = 3
[domain/default] auth_provider = krb5 krb5_kpasswd = dc1.example.com,dc2.example.com,dc3.example.com krb5_kdcip = dc1.example.com,dc2.example.com,dc3.example.com krb5_realm = example.com krb5_server = dc1.example.com,dc2.example.com,dc3.example.com chpass_provider = krb5 cache_credentials = True
id_provider = ldap ldap_id_use_start_tls = False ldap_user_uid_number = msSFU30UidNumber ldap_user_gid_number = msSFU30GidNumber ldap_user_principal = userPrincipalName ldap_force_upper_case_realm = False ldap_group_gid_number = msSFU30GidNumber ldap_uri = ldap://dc1.example.com,ldap://dc2.example.com,ldap://dc3.example.com ldap_user_home_directory = msSFU30HomeDirectory ldap_user_object_class = person ldap_group_object_class = group ldap_group_name = msSFU30Name ldap_user_name = msSFU30Name ldap_search_base = dc=example,dc=com ldap_default_authtok_type = password ldap_default_bind_dn = cn="Linux LDAP",ou=IT,dc=example,dc=com ldap_user_shell = msSFU30LoginShell ldap_default_authtok = PASSWORD_GOES_HERE ldap_tls_cacertdir = /etc/openldap/cacerts min_id = 10000 max_id = 999999 enumerate = True ldap_pwd_policy = none ldap_search = dc=example,dc=com ldap_schema = rfc2307bis debug_level = 9
First, I'd like to mention that SSSD is not currently the ideal solution for interacting with ActiveDirectory. (Currently, we are implementing a winbind-based provider that should be ready within the next two months).
Second, the user list isn't the best place to get this help. Please open a Bugzilla ticket against the SSSD component and attach your sssd.conf as well as the /etc/sssd/sssd/sssd_default.log to it. We'll get you sorted out.