ehlo,
We used internal fq name in ldap filter
with id_provider proxy to files and auth provider
ldap
[sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x0400): calling ldap_search_ext with
[(&(uid=testuser1@ldap)(objectclass=posixAccount))][dc=example,dc=com].
How to reproduce:
* create local user "useradd testuser1"
* add user to ldap with password
dn: uid=testuser1,$DS_BASE_DN
objectClass: account
objectClass: posixAccount
cn: testuser1
uidNumber: 112211
gidNumber: 112211
homeDirectory: /home/testuser1
userPassword: Secret123
* use id_provider proxy to files and auth_provider ldap
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[domain/LDAP]
id_provider = proxy
proxy_lib_name = files
auth_provider = ldap
ldap_uri = ldap://$SERVER
ldap_search_base = $DS_BASE_DN
ldap_tls_cacert = /etc/openldap/certs/cacert.asc
* change a pam stack little bit
(the default fedora pam stack is not friendly for such setup)
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass use_first_pass
auth required pam_deny.so
* try to authenticate
LS