-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/02/2010 10:06 AM, Patrik Martinsson wrote:
Hello,
I've successfully setup'ed sssd on our systems to connect to our
Microsoft AD with ldap
authentication, now i want to use kerberos instead, and have I of course
ran into some problems :)
To start with, I'm not to familiar with kerberos so go easy on me here.
I've successfully created a machineaccount in AD (with msktutil, also
got it working with samba/net join)
and obtained a kerberos keytab. A user can obtain a ticket by running
'kinit foouser', thereafter he/she
can run for example 'ldapsearch -b 'ou=xx,dc=xx,dc=xx,dc=xx' -Omaxssf=0
"(&(objectclass=user)(cn=xx))" uid'
successfully.
Here's to my question, (maybe this rather should be in a kerberos
mailinglist, or maybe i should read a book however it's easiest to ask
here :))
Is the keytab used by sssd to authenticate to the kdc, is this even how
it works ? Since the sssd is runned by root and root has no ticket,
i figured it would work that way, but maybe I'm mistaken, maybe it's
suppose to work in some other way ?
SSSD does not authenticate against a KDC. We can validate the TGT with a
host keytab, however (this proves that the response came from a real
KDC). This would be done by setting:
krb5_keytab = /etc/krb5.keytab
krb5_validate = True
That said, I think this is irrelevant to the issue at hand.
Here's the krb5 part of the sssd.conf
auth_provider = krb5
krb5_kdcip = 123.123.123.123
krb5_realm = foo
krb5_changepw_principle = kadmin/changepw
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15
krb5_keytab = /etc/krb5.keytab
When i start sssd with -d10 i cant really see much messages about the
kerberos authentication whether it fails or not,
Instead of starting with -d10, start with --debug-to-files and look in
/var/log/sssd. Kerberos authentication errors will appear in
/var/log/sssd/krb5_child.log and all other errors for this domain should
appear in /var/log/sssd/sssd_<domain>.log
however i can see
'Search result: Operations error(1), 00000000: LdapErr:
DSID-0C090627,
comment: In order to perform this operation a successful bind must be
completed on the connection., data 0, vece'
which suggest that i cannot bind to ldap, right ?
Would you mind including the LDAP portion of your sssd.conf? This issue
seems to be with LDAP, not Kerberos.
Any suggestions where to go from here, ?
Best regards,
Patrik Martinsson, Sweden.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkxW0nUACgkQeiVVYja6o6NyhwCfdEn0TqA/UlwaaxZGH5k3E+oT
QEYAnR87flpKlSpgrABs9w/qcwqV2NVd
=L9GF
-----END PGP SIGNATURE-----