On Thu, Jun 09, 2011 at 09:20:24AM +0200, Frank Dornheim wrote:
> Hi list,
>
> i have a running sssd, ldap, krb5 system.
>
> client [sssd] --> [openLdap] --> KRB5
>
> So everything work expected. My LDAP user use LDAP/ KRB5 if there is a
> connect and sssd is offline.
>
> But i dont understand the chpass_provider. For a basic orientation are
> example config at the end.
> If i try to change my password and the LDAP/ Kerberos- server is
> stopped i get an: "System is offline, password change not possible".
> But if the LDAP/Kerberos- server is online i use PAM to change the kerberos PW.
>
> So why i should configure the chpass_provider and in which
> circumstances sssd the chpass_provider.
You still have pam_krb5 in your pam configuration and authentication and
password changes and handled by pam_krb. If you use sssd you can remove
pam_krb5 from your pam configuration and set 'auth_provider = krb5' to
let sssd handle kerberos authentication. Also password changes will be
handled by sssd if you remove pam_krb5 and set 'chpass_provider = krb5'.
HTH
bye,
Sumit
>
>
> Thanks Con
>
> __my sssd.conf conf__
>
> [
domain/EXAMPLE.ORG]
> auth_provider = ldap
> id_provider = ldap
> ldap_schema = rfc2307
> ldap_uri =
ldaps://ldap.example.org
> ldap_search_base = dc=example,dc=org
> ldap_user_search_base = ou=users,dc=example,dc=org
> ldap_group_search_base = ou=groups,dc=example,dc=org
> ldap_default_bind_dn = cn=unpriv-ldap-nss-srv,ou=services,dc=example,dc=org
> ldap_default_authtok_type = password
> ldap_default_authtok = securepass
> krb5_server =
kerberos.example.org
> krb5_kpasswd =
kerberos.example.org
> krb5_changepw_principal = kadmin/changepw
> krb5_realm =
EXAMPLE.ORG
> ldap_pwd_policy = mit_kerberos
> chpass_provider=krb5
> ldap_tls_reqcert = demand
> ldap_tls_cacert = /etc/ssl/certs/cacert.pem
> cache_credentials = true
> enumerate = False
> min_id = 10000
> max_id = 29999
>
> __my auth-client-config__
> [sssd.krb5]
> nss_passwd= passwd: compat sss
> nss_group= group: compat sss
> nss_shadow= shadow: compat
> nss_netgroup= netgroup: nis
>
> pam_auth= auth required pam_env.so
> auth [success=4 default=ignore] pam_krb5.so
> try_first_pass
> auth [success=3 default=ignore] pam_unix.so
> debug nullok_secure try_first_pass
> auth requisite
> pam_succeed_if.so uid >= 10000 quiet
> auth [success=1 default=ignore] pam_sss.so
> use_first_pass
> auth requisite pam_deny.so
> auth required pam_permit.so
>
> pam_account= account required
> pam_krb5.so
> account required
> pam_unix.so
> account sufficient
> pam_localuser.so
> account sufficient
> pam_succeed_if.so uid < 10000 quiet
> account [default=bad success=ok user_unknown=ignore]
> pam_sss.so
> account required
> pam_permit.so
>
> pam_password= password requisite pam_cracklib.so
> try_first_pass difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
> password sufficient pam_krb5.so
> try_first_pass use_authtok
> password sufficient pam_unix.so
> try_first_pass use_authtok sha512
> password sufficient pam_sss.so use_authtok
> password required pam_deny.so
>
> pam_session= session required
> pam_mkhomedir.so skel=/etc/skel/ umask=0077
> session optional pam_keyinit.so revoke
> session optional pam_krb5.so
> session required pam_limits.so
> session [success=1 default=ignore] pam_sss.so
> session required pam_unix.so
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://fedorahosted.org/mailman/listinfo/sssd-devel
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel