You're right, and that was using LDAP.
When trying to get sss_ssh_authorizedkeys working on my FreeIPA host itself
just now (which of course uses id_provider = ipa), I actually encountered
this problem again, too. There it was related to the fact that
sss_ssh_authorizedkeys queries the implicit_files domain first. When
explicitly specifying the correct domain, it works. Not sure how to
properly fix this though.
On Tue, 23 Oct 2018 at 15:28, Alexander Bokovoy <abokovoy(a)redhat.com> wrote:
On ti, 23 loka 2018, Johannes Falke via FreeIPA-users wrote:
>For posterity, I had the same issue and fixed it by explicitly setting
>
> ldap_user_ssh_public_key = ipaSshPubKey
>
>in the domain portion of sssd.conf. Otherwise I assume it looks for the
>attribute "sshPublicKey", since that's what it's called in the sssd
cache
>DB.
ipasshpubkey is the default for 'id_provider = ipa', so you don't need
to change that if you are actually using IPA id provider.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland