Hi list,
i have a running sssd, ldap, krb5 system.
client [sssd] --> [openLdap] --> KRB5
So everything work expected. My LDAP user use LDAP/ KRB5 if there is a
connect and sssd is offline.
But i dont understand the chpass_provider. For a basic orientation are
example config at the end.
If i try to change my password and the LDAP/ Kerberos- server is
stopped i get an: "System is offline, password change not possible".
But if the LDAP/Kerberos- server is online i use PAM to change the kerberos PW.
So why i should configure the chpass_provider and in which
circumstances sssd the chpass_provider.
Thanks Con
__my sssd.conf conf__
[
domain/EXAMPLE.ORG]
auth_provider = ldap
id_provider = ldap
ldap_schema = rfc2307
ldap_uri =
ldaps://ldap.example.org
ldap_search_base = dc=example,dc=org
ldap_user_search_base = ou=users,dc=example,dc=org
ldap_group_search_base = ou=groups,dc=example,dc=org
ldap_default_bind_dn = cn=unpriv-ldap-nss-srv,ou=services,dc=example,dc=org
ldap_default_authtok_type = password
ldap_default_authtok = securepass
krb5_server =
kerberos.example.org
krb5_kpasswd =
kerberos.example.org
krb5_changepw_principal = kadmin/changepw
krb5_realm =
EXAMPLE.ORG
ldap_pwd_policy = mit_kerberos
chpass_provider=krb5
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/cacert.pem
cache_credentials = true
enumerate = False
min_id = 10000
max_id = 29999
__my auth-client-config__
[sssd.krb5]
nss_passwd= passwd: compat sss
nss_group= group: compat sss
nss_shadow= shadow: compat
nss_netgroup= netgroup: nis
pam_auth= auth required pam_env.so
auth [success=4 default=ignore] pam_krb5.so
try_first_pass
auth [success=3 default=ignore] pam_unix.so
debug nullok_secure try_first_pass
auth requisite
pam_succeed_if.so uid >= 10000 quiet
auth [success=1 default=ignore] pam_sss.so
use_first_pass
auth requisite pam_deny.so
auth required pam_permit.so
pam_account= account required
pam_krb5.so
account required
pam_unix.so
account sufficient
pam_localuser.so
account sufficient
pam_succeed_if.so uid < 10000 quiet
account [default=bad success=ok user_unknown=ignore]
pam_sss.so
account required
pam_permit.so
pam_password= password requisite pam_cracklib.so
try_first_pass difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password sufficient pam_krb5.so
try_first_pass use_authtok
password sufficient pam_unix.so
try_first_pass use_authtok sha512
password sufficient pam_sss.so use_authtok
password required pam_deny.so
pam_session= session required
pam_mkhomedir.so skel=/etc/skel/ umask=0077
session optional pam_keyinit.so revoke
session optional pam_krb5.so
session required pam_limits.so
session [success=1 default=ignore] pam_sss.so
session required pam_unix.so