[PATCH] PROXY: Use right name in ldap filter
by Lukas Slebodnik
ehlo,
We used internal fq name in ldap filter
with id_provider proxy to files and auth provider
ldap
[sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x0400): calling ldap_search_ext with
[(&(uid=testuser1@ldap)(objectclass=posixAccount))][dc=example,dc=com].
How to reproduce:
* create local user "useradd testuser1"
* add user to ldap with password
dn: uid=testuser1,$DS_BASE_DN
objectClass: account
objectClass: posixAccount
cn: testuser1
uidNumber: 112211
gidNumber: 112211
homeDirectory: /home/testuser1
userPassword: Secret123
* use id_provider proxy to files and auth_provider ldap
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[domain/LDAP]
id_provider = proxy
proxy_lib_name = files
auth_provider = ldap
ldap_uri = ldap://$SERVER
ldap_search_base = $DS_BASE_DN
ldap_tls_cacert = /etc/openldap/certs/cacert.asc
* change a pam stack little bit
(the default fedora pam stack is not friendly for such setup)
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass use_first_pass
auth required pam_deny.so
* try to authenticate
LS
7 years
[PATCHSET] BUILD: Improve a little bit the "prerelease-*" targets
by Fabiano Fidêncio
Howdy!
I've been using a lot the "make prerelease-rpms" command and I've
found out the fact that all the resulting rpms of 2 (or more builds)
are put in the same buildroot/RPMS/{x86_64,noarch}/ directory a bit
unfortunate. It's not exactly handy to find out which are the packages
I want to copy to my guest and deleting the buildroot before doing the
build is also not so cool, as I may want to check stuff from two
different builds.
With this problem in mind, I came with this patchset that generates
the rpms/srpm in a specific folder for each build, which makes my life
way easier when I want to copy those rpms to my guest and do my tests
there.
Please, see the attached patches.
Best Regards,
--
Fabiano Fidêncio
7 years
'no primary group ID provided' when using AD in ldap mode
by Daniel Hermans
Hi,
i'd like to use sssd in ldap mode:
id_provider = ldap
auth_provider = ldap
against an Active Directory domain. Yes krb5 would be better but i only have a BIND account and cannot add computer objects.
Reading guides here:
https://wiki.ubuntu.com/Enterprise/Authentication/sssd
it says i don't need Posix attributes (which I don't have), so I have enabled:
ldap_id_mapping = true
fallback_homedir = /home/%d/%u
default_shell = /bin/bash
I can bind with LDAPS and can seem to get user info from the domain:
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=Some User,OU=Admin Accounts,DC=dev,DC=somedomain,DC=com].
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [displayName]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [memberOf]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [userAccountControl]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [primaryGroupID]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [accountExpires]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [userPrincipalName]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimeStamp]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_result] (0x2000): Trace: sh[0x7f5d15fbc030], connected[1], ops[0x7f5d1639d140], ldap[0x7f5d15fb5cd0]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_op_destructor] (0x2000): Operation 3 finished
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results.
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x4000): Retrieved total 1 users
The UID mapping seems to succeed:
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [ldb] (0x4000): start ldb transaction (nesting: 0)
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Save user
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x4000): Failed to retrieve UUID [2][No such file or directory].
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_primary_name] (0x0400): Processing object someuser
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Processing user someuser
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x1000): Mapping user [someuser] objectSID [S-1-5-21-3970895924-989261097-3267629119-1443] to unix ID
But it gets no further with this message:
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_idmap_primary_gid] (0x0080): no primary group ID provided
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Cannot get the GID for [someuser] in domain [extdev].
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Failed to save user [someuser]
(Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring.
Any ideas what I'm doing wrong?
Is this possible? Various (old) posts suggests it is.
Have tried against two different domains with identical result ( one a cleanly installed 2012R2 domain ).
Thanks in advance!!
7 years
tasks for newcomers or non-developers
by Jakub Hrozek
Hi,
Over the last couple of weeks, I've talked to several people, mostly
engineers with not too much development experience, who said they would
like to start contributing little fixes to SSSD. I would like to find some
tasks that they can easily handle without making their had spin from
looking at harder stuff like asynchronous tevent code :-)
In the past, we used the 'easyfix' tag in the sssd tickets. We still had
some, but not enough. I tagged quite a few today, but if anyone knows
about more easy fixes, please tag them as well.
https://fedorahosted.org/sssd/report/34
Can anybody think of more tasks to ask newcomes to do? I know adding
tests would be great, tests don't require C knowledge, but only Python.
But we would have to document how to write new tests, currently the
process is very convoluted.
We also need to improve and fix documentation on the wiki.
Anything else?
7 years