SSSD (LDAP and Kerberos) to AD

[Stephen Gallagher]

On Tue, 2011-05-31 at 13:58 +0000, Ethan Bonick wrote:
> I am having trouble getting sssd to work properly with LDAP. I am
> using kerberos for passwords and LDAP for identification. I have
> everything working on Ubuntu and CENTOS5 clients not using SSSD so I
> know it works. 
> 
> Kerberos works just fine and I can get a ticket. LDAP returns nothing,
> debug logs aren't helping me. I have included a copy of my config
> file. We are not using certs on ldap and it shouldn't be required
> since I am using kerberos for authentication.
> 
> Thanks,
> Ethan
> 
> [sssd]
> config_file_version = 2
> reconnection_retries = 3
> sbus_timeout = 30
> services = nss, pam
> domains = default
> 
> [nss]
> filter_groups = root
> filter_users = root, nimda
> reconnection_retries = 3
> 
> [pam]
> reconnection_retries = 3
> 
> [domain/default]
> auth_provider = krb5
> krb5_kpasswd = dc1.example.com,dc2.example.com,dc3.example.com
> krb5_kdcip = dc1.example.com,dc2.example.com,dc3.example.com
> krb5_realm = example.com
> krb5_server = dc1.example.com,dc2.example.com,dc3.example.com
> chpass_provider = krb5
> cache_credentials = True
> 
> id_provider = ldap
> ldap_id_use_start_tls = False
> ldap_user_uid_number = msSFU30UidNumber
> ldap_user_gid_number = msSFU30GidNumber
> ldap_user_principal = userPrincipalName
> ldap_force_upper_case_realm = False
> ldap_group_gid_number = msSFU30GidNumber
> ldap_uri =
> ldap://dc1.example.com,ldap://dc2.example.com,ldap://dc3.example.com
> ldap_user_home_directory = msSFU30HomeDirectory
> ldap_user_object_class = person
> ldap_group_object_class = group
> ldap_group_name = msSFU30Name
> ldap_user_name = msSFU30Name
> ldap_search_base = dc=example,dc=com
> ldap_default_authtok_type = password
> ldap_default_bind_dn = cn="Linux LDAP",ou=IT,dc=example,dc=com
> ldap_user_shell = msSFU30LoginShell
> ldap_default_authtok = PASSWORD_GOES_HERE
> ldap_tls_cacertdir = /etc/openldap/cacerts
> min_id = 10000
> max_id = 999999
> enumerate = True
> ldap_pwd_policy = none
> ldap_search = dc=example,dc=com
> ldap_schema = rfc2307bis
> debug_level = 9
> 


First, I'd like to mention that SSSD is not currently the ideal solution
for interacting with ActiveDirectory. (Currently, we are implementing a
winbind-based provider that should be ready within the next two months).

Second, the user list isn't the best place to get this help. Please open
a Bugzilla ticket against the SSSD component and attach your sssd.conf
as well as the /etc/sssd/sssd/sssd_default.log to it. We'll get you
sorted out.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
Url : http://lists.fedoraproject.org/pipermail/users/attachments/20110602/4e5cf2fc/attachment.bin