Ok, thanks again for the patience.
I've realized that I misunderstood that part about the authentication
and the binding against ldap, thanks very much for the explanation.
Now it works correctly with the lookup of the users, however i cant get
it to work with pam, i havent digged that deep yet, but here's what i did.
Added the pam_sss.so to /etc/pam/system-auth accourding to your website
and tried to log in and realized it didn't work.
It's definitely contacting sssd and sssd is trying to look up the user
but fails for some reason, I tried with both auth_providers (krb/ldap)
and both yield the same results, here's the log, maybe you have some
suggestions to that too ?
As i said earlier, a regular kinit username works so the kerberos config
should be ok.
If i run, sssd --debug-to-files with auth_provider krb5 the
krb5_child.log is empty.
Here's how it looks when i use the -d10 and sshing to the machine with
auth_provide krb5.
----
(Mon Aug 2 17:22:06 2010) [sssd[nss]] [get_client_cred] (9): Client
creds: euid[0] egid[0] pid[26077].
(Mon Aug 2 17:22:06 2010) [sssd[nss]] [accept_fd_handler] (4): Client
connected!
(Mon Aug 2 17:22:06 2010) [sssd[nss]] [sss_cmd_get_version] (5):
Received client version [1].
(Mon Aug 2 17:22:06 2010) [sssd[nss]] [sss_cmd_get_version] (5):
Offered version [1].
(Mon Aug 2 17:22:06 2010) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [xx] from [<ALL>]
(Mon Aug 2 17:22:06 2010) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [xx@XX]
(Mon Aug 2 17:22:06 2010) [sssd[nss]] [nss_cmd_getpwnam_callback] (6):
Returning info for user [xx]
(Mon Aug 2 17:22:07 2010) [sssd] [services_startup_timeout] (6):
Handling timeout
(Mon Aug 2 17:22:12 2010) [sssd] [service_check_alive] (4): Checking
service XX(26074) is still alive
(Mon Aug 2 17:22:12 2010) [sssd] [service_send_ping] (4): Pinging XX
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_add_timeout] (8): 0xd74080
(Mon Aug 2 17:22:12 2010) [sssd] [service_check_alive] (4): Checking
service nss(26075) is still alive
(Mon Aug 2 17:22:12 2010) [sssd] [service_send_ping] (4): Pinging nss
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_add_timeout] (8): 0xd71800
(Mon Aug 2 17:22:12 2010) [sssd[be[XX]]] [sbus_dispatch] (9): dbus
conn: 164A330
(Mon Aug 2 17:22:12 2010) [sssd] [service_check_alive] (4): (Mon Aug 2
17:22:12 2010) [sssd[be[XX]]] [sbus_dispatch] (9): Checking service
pam(26076) is still alive
Dispatching.
(Mon Aug 2 17:22:12 2010) [sssd] [service_send_ping] (4): Pinging pam
(Mon Aug 2 17:22:12 2010) [sssd[be[XX]]] [sbus_message_handler] (9):
Received SBUS method [ping]
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_add_timeout] (8): 0xd700c0
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [sbus_dispatch] (9): dbus conn:
E9F3F0
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [sbus_dispatch] (9): Dispatching.
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_remove_timeout] (8): (Mon Aug 2
17:22:12 2010) [sssd[nss]] [sbus_message_handler] (9): 0xd74080
Received SBUS method [ping]
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_dispatch] (9): (Mon Aug 2
17:22:12 2010) [sssd[pam]] [sbus_dispatch] (9): dbus conn: D71C70
dbus conn: 9EEF50
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_dispatch] (9): (Mon Aug 2
17:22:12 2010) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
Dispatching.
(Mon Aug 2 17:22:12 2010) [sssd] [ping_check] (4): Service XX replied
to ping
(Mon Aug 2 17:22:12 2010) [sssd[pam]] [sbus_message_handler] (9):
Received SBUS method [ping]
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_remove_timeout] (8): 0xd71800
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_dispatch] (9): dbus conn: D746C0
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_dispatch] (9): Dispatching.
(Mon Aug 2 17:22:12 2010) [sssd] [ping_check] (4): Service nss replied
to ping
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_remove_timeout] (8): 0xd700c0
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_dispatch] (9): dbus conn: D736E0
(Mon Aug 2 17:22:12 2010) [sssd] [sbus_dispatch] (9): Dispatching.
(Mon Aug 2 17:22:12 2010) [sssd] [ping_check] (4): Service pam replied
to ping
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [xx] from [<ALL>]
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [xx@XX]
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [nss_cmd_getpwnam_callback] (6):
Returning info for user [xx]
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [xx] from [<ALL>]
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [xx@XX]
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [nss_cmd_getpwnam_callback] (6):
Returning info for user [xx]
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [xx] from [<ALL>]
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [xx@XX]
(Mon Aug 2 17:22:12 2010) [sssd[nss]] [nss_cmd_getpwnam_callback] (6):
Returning info for user [xx]
(Mon Aug 2 17:22:12 2010) [sssd[be[XX]]] [cleanup_users_send] (9):
Cache expiration is set to 0 days
(Mon Aug 2 17:22:12 2010) [sssd[be[XX]]]
[sysdb_search_users_check_handle] (6): Search users with filter:
(&(objectclass=user)(&(!(dataExpireTimestamp=0))(dataExpireTimestamp<=1280762532)(!(lastLogin=*))))
(Mon Aug 2 17:22:12 2010) [sssd[be[XX]]] [sysdb_search_entry_done] (6):
Error: Entry not Found!
(Mon Aug 2 17:22:12 2010) [sssd[be[XX]]]
[sysdb_search_groups_check_handle] (6): Search groups with filter:
(&(objectclass=group)(&(!(dataExpireTimestamp=0))(dataExpireTimestamp<=1280762532)))
(Mon Aug 2 17:22:12 2010) [sssd[be[XX]]] [sysdb_search_entry_done] (6):
Error: Entry not Found!
(Mon Aug 2 17:22:12 2010) [sssd[be[XX]]] [ldap_id_cleanup_set_timer]
(6): Scheduling next cleanup at 1280773332.415082
Pam looks like this,
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in
crond quiet use_uid
session sufficient pam_sss.so
session required pam_unix.so
/Patrik
On 08/02/2010 04:44 PM, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/02/2010 10:38 AM, Patrik Martinsson wrote:
> If i change, auth_provider to ldap instead of krb5 and add,
> ldap_default_bind_dn = cn=xx,ou=People,dc=xx,dc=xx,dc=xx
> ldap_default_authtok_type = password
> ldap_default_authtok = xx
>
> Then i got the expected result.
> It's only when i change sssd to use krb authentication it fails.
>
>
Try leaving the ldap_default_* options alone and just changing
auth_provider = krb5
krb5_kdcip =<IP or FQDN>
The options you have set above have nothing to do with authentication.
They're used to set the bind type that SSSD itself users to query the
LDAP server for the list of acceptable usernames. It's not used for
authenticating the users themselves.
So when you removed those lines to set up Kerberos, you made it so that
the SSSD cannot look up usernames, and thus would not be able to perform
an authentication against Kerberos.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkxW2bgACgkQeiVVYja6o6OQiQCfWbr2HRfpYMCOY/NKt6/nlcTI
l8sAoKCUKQfC69JAMkRBUX8nT8xVE2ss
=ryB5
-----END PGP SIGNATURE-----
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel