For posterity, I had the same issue and fixed it by explicitly setting
ldap_user_ssh_public_key = ipaSshPubKey
in the domain portion of sssd.conf. Otherwise I assume it looks for the attribute "sshPublicKey", since that's what it's called in the sssd cache DB.
On ti, 23 loka 2018, Johannes Falke via FreeIPA-users wrote:
For posterity, I had the same issue and fixed it by explicitly setting
ldap_user_ssh_public_key = ipaSshPubKey
in the domain portion of sssd.conf. Otherwise I assume it looks for the attribute "sshPublicKey", since that's what it's called in the sssd cache DB.
ipasshpubkey is the default for 'id_provider = ipa', so you don't need to change that if you are actually using IPA id provider.
You're right, and that was using LDAP.
When trying to get sss_ssh_authorizedkeys working on my FreeIPA host itself just now (which of course uses id_provider = ipa), I actually encountered this problem again, too. There it was related to the fact that sss_ssh_authorizedkeys queries the implicit_files domain first. When explicitly specifying the correct domain, it works. Not sure how to properly fix this though.
On Tue, 23 Oct 2018 at 15:28, Alexander Bokovoy abokovoy@redhat.com wrote:
On ti, 23 loka 2018, Johannes Falke via FreeIPA-users wrote:
For posterity, I had the same issue and fixed it by explicitly setting
ldap_user_ssh_public_key = ipaSshPubKey
in the domain portion of sssd.conf. Otherwise I assume it looks for the attribute "sshPublicKey", since that's what it's called in the sssd cache DB.
ipasshpubkey is the default for 'id_provider = ipa', so you don't need to change that if you are actually using IPA id provider.
-- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
Johannes Falke