On Thu, Jun 09, 2011 at 09:20:24AM +0200, Frank Dornheim wrote:
Hi list,
i have a running sssd, ldap, krb5 system.
client [sssd] --> [openLdap] --> KRB5
So everything work expected. My LDAP user use LDAP/ KRB5 if there is a
connect and sssd is offline.
But i dont understand the chpass_provider. For a basic orientation are
example config at the end.
If i try to change my password and the LDAP/ Kerberos- server is
stopped i get an: "System is offline, password change not possible".
But if the LDAP/Kerberos- server is online i use PAM to change the kerberos PW.
So why i should configure the chpass_provider and in which
circumstances sssd the chpass_provider.
You still have pam_krb5 in your pam configuration and authentication and
password changes and handled by pam_krb. If you use sssd you can remove
pam_krb5 from your pam configuration and set 'auth_provider = krb5' to
let sssd handle kerberos authentication. Also password changes will be
handled by sssd if you remove pam_krb5 and set 'chpass_provider = krb5'.
HTH
bye,
Sumit
Thanks Con
__my sssd.conf conf__
[
domain/EXAMPLE.ORG]
auth_provider = ldap
id_provider = ldap
ldap_schema = rfc2307
ldap_uri =
ldaps://ldap.example.org
ldap_search_base = dc=example,dc=org
ldap_user_search_base = ou=users,dc=example,dc=org
ldap_group_search_base = ou=groups,dc=example,dc=org
ldap_default_bind_dn = cn=unpriv-ldap-nss-srv,ou=services,dc=example,dc=org
ldap_default_authtok_type = password
ldap_default_authtok = securepass
krb5_server =
kerberos.example.org
krb5_kpasswd =
kerberos.example.org
krb5_changepw_principal = kadmin/changepw
krb5_realm =
EXAMPLE.ORG
ldap_pwd_policy = mit_kerberos
chpass_provider=krb5
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/cacert.pem
cache_credentials = true
enumerate = False
min_id = 10000
max_id = 29999
__my auth-client-config__
[sssd.krb5]
nss_passwd= passwd: compat sss
nss_group= group: compat sss
nss_shadow= shadow: compat
nss_netgroup= netgroup: nis
pam_auth= auth required pam_env.so
auth [success=4 default=ignore] pam_krb5.so
try_first_pass
auth [success=3 default=ignore] pam_unix.so
debug nullok_secure try_first_pass
auth requisite
pam_succeed_if.so uid >= 10000 quiet
auth [success=1 default=ignore] pam_sss.so
use_first_pass
auth requisite pam_deny.so
auth required pam_permit.so
pam_account= account required
pam_krb5.so
account required
pam_unix.so
account sufficient
pam_localuser.so
account sufficient
pam_succeed_if.so uid < 10000 quiet
account [default=bad success=ok user_unknown=ignore]
pam_sss.so
account required
pam_permit.so
pam_password= password requisite pam_cracklib.so
try_first_pass difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password sufficient pam_krb5.so
try_first_pass use_authtok
password sufficient pam_unix.so
try_first_pass use_authtok sha512
password sufficient pam_sss.so use_authtok
password required pam_deny.so
pam_session= session required
pam_mkhomedir.so skel=/etc/skel/ umask=0077
session optional pam_keyinit.so revoke
session optional pam_krb5.so
session required pam_limits.so
session [success=1 default=ignore] pam_sss.so
session required pam_unix.so
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel