We've been experimenting with putty v0.61 and windows SSO authentication. e.g. You log into windows with username "tim" and when then load up putty and try and connect to a RHEL6 machine, it passes along my Windows GSSAPI credentials and automatically logs me in to the RHEL6 box.
SSSD has been configured to talk to Active Directory like so:
enumerate = True
ldap_id_use_start_tls = False
cache_credentials = True
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
debug_level = 1
ldap_schema = rfc2307bis
ldap_force_upper_case_realm = True
ldap_user_object_class = user
ldap_group_object_class = group
ldap_user_home_directory = unixHomeDirectory
ldap_user_name = msSFU30Name
ldap_user_member_of = msSFU30PosixMemberOf
ldap_group_member = msSFU30PosixMember
access_provider = ldap
ldap_uri = ldap://xxxx/
ldap_search_base = xxx
ldap_user_search_base = xxx
ldap_group_search_base = xxx
ldap_sasl_mech = gssapi
ldap_sasl_authid = xxx
ldap_krb5_keytab = xxx
ldap_krb5_init_creds = true
ldap_tls_cacertdir = /etc/openldap/cacerts
krb5_realm = xxx
krb5_kpasswd = xxx
krb5_server = xxx
What we're finding is Windows for some reason stores the username in UPPERCASE and passes the uppercase value in the GSSAPI credentials. However the username attribute in AD (msSFU30Name) stores the username in lowercase, which is the standard for Unix usernames and something we are very comfortable with.
Because the username comparison is case-sensitive, the user is denied access. If we hard-code the login name in putty to be lowercase it works, so I'm pretty sure the GSSAPI auth is working.
So, my question is: Is there a way to make the username comparison to LDAP case-insensitive? Or do we need to update our AD/LDAP to uppercase all the msSFU30Name attributes? Or is there another option?
I understand usernames should be compared case-sensitive to be POSIX compliant. I've just been asked to see if I can get this to work.
BTW I've been browsing trac and it looks like you were considering a "force_lowercase_names" config option at one point. Is this still under consideration? https://fedorahosted.org/sssd/ticket/246
This e-mail is sent by Suncorp Group Limited ABN 66 145 290 124 or one of its related entities "Suncorp".
Suncorp may be contacted at Level 18, 36 Wickham Terrace, Brisbane or on 13 11 55 or at suncorp.com.au.
The content of this e-mail is the view of the sender or stated author and does not necessarily reflect the view of Suncorp. The content, including attachments, is a confidential communication between Suncorp and the intended recipient. If you are not the intended recipient, any use, interference with, disclosure or copying of this e-mail, including attachments, is unauthorised and expressly prohibited. If you have received this e-mail in error please contact the sender immediately and delete the e-mail and any attachments from your system.
I have this nsswitch configuration:
#shadow: files ldap
#group: files ldap
#passwd: files sss
#passwd: compat sss
shadow: files sss
group: files sss
hosts: files dns
automount: files ldap
sudoers: files ldap
Currently I am having problems with sssd handling netgroup changes.
when I add or remove a user from a netgroup , those changes are not replicated automatically to clients . Should be something wrong with my sssd.conf configuration ?
If you can give me a hand I would really appreciate it.
while testing vetoed_shells I happened to notice it is missing from
sssd.api.conf, the attached patch fixes this.
However, there seems to be also ~dozen other configuration options
missing, not sure should those all be added, too.
The list of missing configuration options after this patch is:
localhost:~/sssd.git> for t in `grep -Eo '<term>[a-z_]*'
src/man/sssd.conf.5.xml | sed -e 's,<term>,,g'`; do grep -q $t
src/config/etc/sssd.api.conf || echo $t ; done
The SSSD team is proud to announce the 0.1.3 bugfix release of SSSD.
It can be downloaded from
== Highlights ==
* Fixes a serious bug in libdhash with very large (> 1024 slots)
* Minor bugfixes
== Detailed Changelog ==
Dmitri Pal (2):
* Initializing variables in test
* Freeing memory used for source dir
John Dennis (1):
* Resolves: RHBZ #735464 Fix the loop limit used to initialize the
Stephen Gallagher (6):
* Fix license text for several files that should be LGPLv3+
* Fix incorrect allocation check
* Eliminate memory leak on error
* Bump version for 0.1.3 release
* Update spec file for newer library versions
* Update version numbers for ding-libs 0.1.3 release
Sumit Bose (2):
* Fix typo which makes make prerelease-srpm fail
* Ensure error_string() never returns NULL