On Fri, Jan 24, 2014 at 02:44:49PM +0100, Arturo Borrero wrote:
Hi there!
I've been playing with the SSSD 'ldap_acces_filter' directive.
access_provider = ldap
ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
I expected a similar functionality to the old ldap.conf:
pam_groupdn cn=HOSTNAME,ou=hosts,dc=example,dc=com
pam_member_attribute member
In the old case, a query was issued to the LDAP backend looking for
a member within cn=HOSTNAME,ou=hosts,dc=example,dc=com (the host
object).
In the new case (SSSD), this query is made (excerpt from my OpenLDAP
server):
SRCH base="uid=aborrero,ou=users,dc=example,dc=com" scope=0 deref=0
filter="(&(uid=aborrero)(objectClass=posixAccount)(member=cn=centos6,ou=hosts,dc=example,dc=com))"
This means that SSSD is looking inside the user object, instead of
the host object.
In sssd-ldap(5) I don't see any additional options to configure this
behavior.
To migrate to SSSD I would require to filter member which are
declared within host objects.
Could you please give me some advices about this?
Also, please point me to the right mailing list if this is not the one.
regards.
I'm confused a bit, are you sure pam_groupdn has anything to do with
host objects? Per the pam_ldap man page, the functionality should ensure
that the user logging in is a member of a group with a certain DN:
pam_groupdn <groupdn>
Specifies the distinguished name of a group to which a user must
belong for logon authorization to succeed. pam_member_attribute
<attribute> Specifies the attribute to use when testing a user's
membership of a group specified in the pam_groupdn option.
In that case, maybe the simple access provider would be what you're
looking for?
Can you paste an example of a user entry and the entries that restrict
his login?