If you have the memberOf plugin enabled (and appropriate objectclasses on your accounts), you can use the following ldap_access_filter rule:

ldap_access_filter = memberOf=cn=techops,ou=groups,l=uk,dc=xxxx,dc=lan

That is how we have it set up. Basically, we let 389DS handle generating memberOf attributes for all user accounts via the plugin, and when SSSD checks the user account it uses that filter to see if there is a value of memberOf that is equal to the group we want to allow access to (in your case cn=techops,ou=groups,l=uk,dc=xxxx,dc=lan). 

I believe SSSD is only checking attributes / values on the LDAP entry for the user trying to log in, so I don't think you can have it check for membership entries in the group itself.

On Wed, May 29, 2013 at 8:41 AM, Dan Lavu <dan@lavu.net> wrote:
Try taking out access_provider, if I'm not mistaken that is to be used with the host attribute and pam must have pam_sss.so

Another thing you can do is

access_provider = simple
simple_allow_users = jsmith,bjensen
simple_allow_groups = itgroup

Which will work for ldap groups too.

Dan

On May 28, 2013, at 5:45 PM, Fosiul Alam <fosiul@gmail.com> wrote:

> Hi Bellow is my sssd.conf
>
> with bellow setting, user cant login.
> but if i remove ldap_access_filter , then all user can access
>
> What i am doing wrong...
> i just want user from "techops" group to access this server..
>
>
> any help will be really grateful .
>
> [sssd]
> config_file_version = 2
> services = nss, pam
> domains = LDAP
>
> [nss]
> filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
>
> [pam]
>
> [domain/LDAP]
> id_provider = ldap
> auth_provider = ldap
> ldap_schema = rfc2307
> ldap_uri = ldap://auth2.xxxxxx.lan/,ldap://auth1.xxxxxxxlan/
> ldap_search_base = l=uk,dc=xxxx,dc=lan
> ldap_tls_reqcert = demand
> cache_credentials = true
> enumerate = true
> debug_level = 10
> ldap_tls_cacertdir = /etc/openldap/xxx/
> ldap_tls_cert = /etc/openldap/cacerts/CA-xxx.crt
> access_provider = ldap
> ldap_access_filter = memberUid=cn=techops,ou=groups,l=uk,dc=xxxx,dc=lan
> #entry_cache_timeout = 600
> #ldap_network_timeout = 3
>
>
> and the log i get from secure  file
>
> 2013-05-28T22:13:02.782543+01:00 uk-xxxxx-1 sshd[4172]: pam_sss(sshd:auth): received for user mtest: 9 (Authentication service cannot retrieve authentication info)
> 2013-05-28T22:13:04.597478+01:00 uk-xxxx-1 sshd[4172]: Failed password for mtest from xxx.xx.xx.xx port 52664 ssh2
>
>
> Thanks
>
> --
> 389 users mailing list
> 389-users@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/389-users

--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users