On Sat, 2011-07-23 at 16:07 -0400, Simo Sorce wrote:
On Mon, 2011-07-18 at 21:57 +0000, DeMarco, Dennis J (RIS-BCT)
wrote:
> I am trying to switch over from pam_ldap to use sssd authentication.
>
>
>
> I have host based access based on a static ldap group and use the
> pam_groupdn attribute in /etc/ldap.conf to restrict access to hosts. I
> can not seem to replicate this behavior in SSSD. I have tried every
> combination of ldap_access_filter to no great success.
If you have the 'host' attribute set on each user what you can do is to
set:
access_provider = ldap
ldap_access_filter = host=this.host.value.as.represented.in.ldap
Of course each host will have a different value.
> I do not have Memberof plugin in the old style Fedora DS 1.0.4. Is
> there a way for SSSD to use this style of host base authentication? I
> rather not go with a sssd/pam_ldap hybrid in system-auth.
ldap_access_filter combnined with access_provider = ldap should give you
what you need if you have attributes on users.
If you do not then I suggest you use access_provider = simple and use
the simple_allow_users list, although this one makes it a little harder
because you have to change it manually on every host.
I guess we could evaluate an RFE about adding a new simple_allow_group
option (but not a simple_deny_group one) to the simple access provider,
if you like something like that you may want to open a feature request
bug in our trac instance (requires
fedoraprojetc.org account).
SSSD has supported simple_allow_groups since SSSD 1.4.0. This is
probably the preferred solution for the moment. The catch here is that
this will only work for POSIX groups.
I have also opened
https://fedorahosted.org/sssd/ticket/931 as an RFE to
support group membership for access-control directly in LDAP. This
approach will allow us to support non-POSIX groups as well.