ehlo,
We used internal fq name in ldap filter with id_provider proxy to files and auth provider ldap
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=testuser1@ldap)(objectclass=posixAccount))][dc=example,dc=com].
How to reproduce: * create local user "useradd testuser1" * add user to ldap with password dn: uid=testuser1,$DS_BASE_DN objectClass: account objectClass: posixAccount cn: testuser1 uidNumber: 112211 gidNumber: 112211 homeDirectory: /home/testuser1 userPassword: Secret123
* use id_provider proxy to files and auth_provider ldap [sssd] config_file_version = 2 services = nss, pam domains = LDAP
[domain/LDAP] id_provider = proxy proxy_lib_name = files auth_provider = ldap ldap_uri = ldap://$SERVER ldap_search_base = $DS_BASE_DN ldap_tls_cacert = /etc/openldap/certs/cacert.asc
* change a pam stack little bit (the default fedora pam stack is not friendly for such setup)
auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass use_first_pass auth required pam_deny.so
* try to authenticate
LS
sssd-devel@lists.fedorahosted.org