On Sat, 2011-07-23 at 16:07 -0400, Simo Sorce wrote:
> On Mon, 2011-07-18 at 21:57 +0000, DeMarco, Dennis J (RIS-BCT) wrote:
> > I am trying to switch over from pam_ldap to use sssd authentication.
> >
> >
> >
> > I have host based access based on a static ldap group and use the
> > pam_groupdn attribute in /etc/ldap.conf to restrict access to hosts. I
> > can not seem to replicate this behavior in SSSD. I have tried every
> > combination of ldap_access_filter to no great success.
>
> If you have the 'host' attribute set on each user what you can do is to
> set:
> access_provider = ldap
> ldap_access_filter = host=this.host.value.as.represented.in.ldap
>
> Of course each host will have a different value.
>
> > I do not have Memberof plugin in the old style Fedora DS 1.0.4. Is
> > there a way for SSSD to use this style of host base authentication? I
> > rather not go with a sssd/pam_ldap hybrid in system-auth.
>
> ldap_access_filter combnined with access_provider = ldap should give you
> what you need if you have attributes on users.
>
> If you do not then I suggest you use access_provider = simple and use
> the simple_allow_users list, although this one makes it a little harder
> because you have to change it manually on every host.
>
> I guess we could evaluate an RFE about adding a new simple_allow_group
> option (but not a simple_deny_group one) to the simple access provider,
> if you like something like that you may want to open a feature request
> bug in our trac instance (requires
fedoraprojetc.org account).
>
SSSD has supported simple_allow_groups since SSSD 1.4.0. This is
probably the preferred solution for the moment. The catch here is that
this will only work for POSIX groups.
I have also opened
https://fedorahosted.org/sssd/ticket/931 as an RFE to
support group membership for access-control directly in LDAP. This
approach will allow us to support non-POSIX groups as well.
Ah I guess I was looking at an outdated manpage :-/
Simo.
--
Simo Sorce * Red Hat, Inc * New York