SSSD/LDAP/Kerberos Implementation for Subdomains
by J. Alexander Jacocks
Hello,
I'm trying to implement an SSSD-based LDAP/Kerberos (with the LDAP
authenticator, because we use SFU attributes) configuration, where the
users primarily life at the root of the AD forest.
For example, our tree looks like this:
- example.org -> ou=User Accounts,dc=example,dc=org
|
|--> project1.example.org => ou=User Accounts,dc=project1,dc=example,dc=org
|
|--> project2.example.org => ou=User Accounts,dc=project2,dc=example,dc=org
So, most user accounts are loated in the top accounts container, with a few
accounts, specific to their projects, located at the lower levels.
Where I am having issues is that my test infrastructure (Windows 2008 R2,
CentOS 6.x) works fine, but the production infrastructure does not. I have
tried a variety of SSSD configs, but the current one looks like this. The
CentOS 6.x host is 'scm.project1.example.org'. I am using the example from
the Red Hat Active Directory Integration white paper, v1.4, so I generated
a krb5.keytab on dc001.project1.example.org, so that
scm.project1.example.org could query for user accounts.
# cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
domains = example.org, project1.example.org
services = nss, pam
debug_level = 0
[nss]
[pam]
[domain/example.org]
debug_level = 5
cache_credentials = True
enumerate = False
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = host/scm.project1.example.org(a)PROJECT1.EXAMPLE.ORG
ldap_schema = rfc2307bis
ldap_user_object_class = user
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_user_name = sAMAccountName
ldap_group_object_class = group
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = True
ldap_referrals = true
krb5_realm = EXAMPLE.ORG
ldap_search_base = dc=example,dc=org
[domain/project1.example.org]
debug_level = 5
cache_credentials = True
enumerate = False
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = host/scm.project1.example.org(a)PROJECT1.EXAMPLE.ORG
ldap_schema = rfc2307bis
ldap_user_object_class = user
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_user_name = sAMAccountName
ldap_group_object_class = group
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = True
ldap_referrals = true
krb5_realm = PROJECT1.EXAMPLE.ORG
ldap_search_base = dc=project1,dc=example,dc=org
[sudo]
[autofs]
[ssh]
[pac]
# cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = EXAMPLE.ORG
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
EXAMPLE.ORG = {
kdc = dc001.example.org
kdc = dc002.example.org
admin_server = dc001.example.org
}
PROJECT1.EXAMPLE.ORG = {
kdc = dc001.project1.example.org
admin_server = dc001.project1.example.org
}
[domain_realm]
example.org = EXAMPLE.ORG
.example.org = EXAMPLE.ORG
project1.example.org = PROJECT1.EXAMPLE.ORG
.project1.example.org = PROJECT1.EXAMPLE.ORG
In the production infrascructure, scm1.project1.example.org doesn't seem to
be able to login, using it's krb5.keytab, to dc001.example.org to make LDAP
queries, and I'm not sure why. For example:
# kinit -k -t /etc/krb5.keytab
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: host/scm.project1.example.org(a)PROJECT1.EXAMPLE.ORG
Valid starting Expires Service principal
12/17/13 16:42:33 12/18/13 02:43:03 krbtgt/
PROJECT1.EXAMPLE.ORG(a)PROJECT1.EXAMPLE.ORG
renew until 12/24/13 16:42:33
12/17/13 16:43:07 12/18/13 02:43:03 krbtgt/EXAMPLE.ORG(a)EXAMPLE.ORG
renew until 12/24/13 16:42:33
# ldapsearch -H ldap://example.org -Y GSSAPI -N -b dc=example,dc=org
"(&(objectClass=user)(sAMAccountName=username))"
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (Realm
not local to KDC)
The "Realm not local to KDC" error could make me think that the search base
that I am requesting isn't the same as that hosted by the domain
controller, but that isn't the case. If I query the local domain (
project1.example.org), I get the expected referral:
# ldapsearch -H ldap://project1.example.org -Y GSSAPI -N -b
dc=example,dc=org "(&(objectClass=user)(sAMAccountName=username))"
SASL/GSSAPI authentication started
SASL username: host/scm.project1.example.org(a)PROJECT1.EXAMPLE.ORG
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=org> with scope subtree
# filter: (&(objectClass=user)(sAMAccountName=username))
# requesting: ALL
#
# search result
search: 4
result: 10 Referral
text: 0000202B: RefErr: DSID-03100742, data 0, 1 access points
ref 1: 'examp
le.org'
ref: ldap://example.org/dc=example,dc=org
# numResponses: 1
Any suggestions would be greatly appreciated.
Thanks!
- Alex
9 years, 5 months
kinit: Client not found in Kerberos database
by Bryan Harris
Sender: sssd-users-bounces(a)lists.fedorahosted.org
On-Behalf-Of: bryanlharris(a)me.com
Subject: [SSSD-users] kinit: Client not found in Kerberos database
Message-Id: <509af88b-d381-49fc-b5e8-b6c778bbdcc3(a)me.com>
Recipient: cklopotowski(a)crabel.com
9 years, 5 months
ldap authentication
by Dan Candea
Hello
Could someone point me in the right direction with what is wrong here,
please? Thank you for any hint.
I want to make ldap authentication without kerberos ( access_provider =
ldap )
TLS/SSL encryption channel is fine, bind user is working, it can find my
testuser and the attributes, but simple bind for checking the password of
the found user is failing with Invalid credentials.
ldapsearch -LLL -h "10.10.10.10" -D "testuser(a)2FA.TEST" -w password -b
"CN=MyUser,CN=Users,DC=2FA,DC=TEST"
is returning the user but sssd fails.
This are the versions I'm using:
ii ldap-utils 2.4.31-1+nmu2 amd64
OpenLDAP utilities
ii libldap-2.4-2:amd64 2.4.31-1+nmu2
amd64 OpenLDAP libraries
ii libsasl2-modules-ldap:amd64
2.1.25.dfsg1-6+deb7u1 amd64 Cyrus SASL -
pluggable authentication modules (LDAP)
ii sssd-ldap 1.11.1-1 amd64
System Security Services Daemon -- LDAP back end
I've checked the pam module and it seams to make that is using the
userPrincipalName for authentication, is this correct?
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_cmd_authenticate] (0x0100):
entering pam_cmd_authenticate
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sss_parse_name_for_domains]
(0x0200): name 'testuser' matched without domain, user is testuser
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sss_parse_name_for_domains]
(0x0200): using default domain [(null)]
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
command: PAM_AUTHENTICATE
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
domain: not set
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100): user:
testuser
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
service: sshd
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100): ruser:
not set
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100): rhost:
192.168.1.1
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
authtok type: 1
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok type: 0
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
cli_pid: 5354
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sss_ncache_check_str] (0x2000):
Checking negative cache for [NCE/USER/2FA.TEST/testuser]
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sss_dp_issue_request] (0x0400):
Issuing request for [0x417df0:3:testuser@2FA.TEST]
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sss_dp_get_account_msg]
(0x0400): *Creating request for [2FA.TEST][3][1][name=testuser]*
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sbus_add_timeout] (0x2000): 0xf2c1d0
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sss_dp_internal_get_send]
(0x0400): *Entering request [0x417df0:3:testuser@2FA.TEST]*
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sbus_remove_timeout] (0x2000):
0xf2c1d0
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sbus_dispatch] (0x4000): dbus
conn: 0xf28e30
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sbus_dispatch] (0x4000):
Dispatching.
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sss_dp_get_reply] (0x1000): *Got
reply from Data Provider - DP error code: 3 errno: 34 error message:
Init group lookup failed*
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_check_user_dp_callback]
(0x0040): Unable to get information from Data Provider
Error: 3, 34, Init group lookup failed
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_check_user_search] (0x0100):
Requesting info for [testuser(a)2FA.TEST]
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0xf2dae0
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [ldb] (0x4000): Added timed event
"ltdb_timeout": 0xf380a0
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [ldb] (0x4000): Destroying timer
event 0xf380a0 "ltdb_timeout"
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [ldb] (0x4000): Ending timer
event 0xf2dae0 "ltdb_callback"
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_check_user_search] (0x0400):
Returning info for user [testuser(a)2FA.TEST]
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_initgr_cache_set] (0x2000):
[testuser] added to PAM initgroup cache
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_dp_send_req] (0x0100):
Sending request with the following data:
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
command: PAM_AUTHENTICATE
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
domain: 2FA.TEST
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100): user:
testuser
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
service: sshd
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100): ruser:
not set
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100): rhost:
192.168.1.1
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
authtok type: 1
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok type: 0
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_print_data] (0x0100):
cli_pid: 5354
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sbus_add_timeout] (0x2000): 0xf29d40
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_dom_forwarder] (0x0100):
pam_dp_send_req returned 0
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sss_dp_req_destructor] (0x0400):
Deleting request: [0x417df0:3:testuser@2FA.TEST]
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sbus_remove_timeout] (0x2000):
0xf29d40
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sbus_dispatch] (0x4000): dbus
conn: 0xf28e30
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [sbus_dispatch] (0x4000):
Dispatching.
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_dp_process_reply] (0x0100):
received: [7][2FA.TEST]
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_reply] (0x0200): pam_reply
called with result [7].
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [pam_reply] (0x0200): blen: 25
(Thu Dec 5 15:29:49 2013) [sssd[pam]] [reset_idle_timer] (0x4000): Idle
timer re-set for client [0xf31510][18]
(Thu Dec 5 15:29:52 2013) [sssd[pam]] [sbus_dispatch] (0x4000): dbus
conn: 0xf252b0
(Thu Dec 5 15:29:52 2013) [sssd[pam]] [sbus_dispatch] (0x4000):
Dispatching.
(Thu Dec 5 15:29:52 2013) [sssd[pam]] [sbus_message_handler] (0x4000):
Received SBUS method [ping]
(Thu Dec 5 15:29:54 2013) [sssd[pam]] [pam_initgr_cache_remove]
(0x2000): [testuser] removed from PAM initgroup cache
Below is the domain log:
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP'
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [get_server_status]
(0x1000): Status of server '2fa-ad.2FA.TEST' is 'working'
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [get_port_status]
(0x1000): Port status of port 636 for server '2fa-ad.2FA.TEST' is 'working'
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6
seconds
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [get_server_status]
(0x1000): Status of server '2fa-ad.2FA.TEST' is 'working'
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[be_resolve_server_process] (0x1000): Saving the first resolved server
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[be_resolve_server_process] (0x0200): Found address for server
2fa-ad.2FA.TEST: [10.10.10.10] TTL 7200
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [sdap_uri_callback]
(0x0400): Constructed uri 'ldaps://2fa-ad.2FA.TEST'
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [auth_resolve_done]
(0x2000): [ldaps://2fa-ad.2FA.TEST] is a secure channel. No need to run
START_TLS
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [sss_ldap_init_send]
(0x4000): Using file descriptor [22] for LDAP connection.
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [sss_ldap_init_send]
(0x0400): Setting 6 seconds timeout for connecting
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldaps://2fa-ad.2FA.TEST:636/??base] with fd [22].
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [fo_set_port_status]
(0x0100): Marking port 636 of server '2fa-ad.2FA.TEST' as 'working'
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[set_server_common_status] (0x0100): Marking server '2fa-ad.2FA.TEST' as
'working'
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [fo_set_port_status]
(0x0400): Marking port 636 of duplicate server '2fa-ad.2FA.TEST' as
'working'
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [ldb] (0x4000): Added
timed event "ltdb_callback": 0x16f1fe0
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [ldb] (0x4000): Added
timed event "ltdb_timeout": 0x16ee9a0
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [ldb] (0x4000):
Destroying timer event 0x16ee9a0 "ltdb_timeout"
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [ldb] (0x4000): Ending
timer event 0x16f1fe0 "ltdb_callback"
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[find_password_expiration_attributes] (0x4000): No password policy
requested.
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [simple_bind_send]
(0x0100): Executing simple bind as: CN=MyUser,CN=Users,DC=2FA,DC=TEST
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [simple_bind_send]
(0x2000): ldap simple bind sent, msgid = 1
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [sdap_process_result]
(0x2000): Trace: sh[0x16b3f40], connected[1], ops[0x16a9ad0],
ldap[0x16d63c0]
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [sdap_process_message]
(0x4000): Message type: [LDAP_RES_BIND]
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [simple_bind_done]
(0x1000): Server returned no controls.
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [simple_bind_done]
(0x0400):*B**ind result: Invalid credentials(49), 80090308: LdapErr:
DSID-0C0903C5, comment: AcceptSecurityContext error, data 52e, v2580*
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]] [sdap_handle_release]
(0x2000): Trace: sh[0x16b3f40], connected[1], ops[(nil)],
ldap[0x16d63c0], destructor_lock[0], release_memory[0]
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[remove_connection_callback] (0x4000): Successfully removed connection
callback.
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[be_pam_handler_callback] (0x0100): Backend returned: (0, 7, <NULL>)
[Success]
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[be_pam_handler_callback] (0x0100): Sending result [7][2FA.TEST]
(Thu Dec 5 15:09:32 2013) [sssd[be[2FA.TEST]]]
[be_pam_handler_callback] (0x0100): Sent result [7][2FA.TEST]
(Thu Dec 5 15:09:40 2013) [sssd[be[2FA.TEST]]] [sbus_dispatch]
(0x4000): dbus conn: 0x169b280
(Thu Dec 5 15:09:40 2013) [sssd[be[2FA.TEST]]] [sbus_dispatch]
(0x4000): Dispatching.
(Thu Dec 5 15:09:40 2013) [sssd[be[2FA.TEST]]] [sbus_message_handler]
(0x4000): Received SBUS method [ping]
--
Dan Cândea
Does God Play Dice?
9 years, 6 months
Long hostname
by Ondrej Valousek
Hi List,
Is there any plan how to deal with hostnames > 16 chars long? I do not know how about IPA, but AD seems to have a problem joining such machines due to some historical NETBIOS dependency.
Please advise - currently I am renaming machines for shorter names which is far from being ideal.
Thanks,
Ondrej
9 years, 6 months
sssd sudo ldap with new AD provider
by Aaron C Johnson
I am trying to get SSSD working with Samba 4 AD including sudo.
I have SSSD working using RFC2307 UNIX attributes which is great.
Now I have extended my AD schema using the schema.ActiveDirectory ldif
that came with my distribution (Debian jessie)
Then I used sudoers2ldif to create an ldif for a simple sudo rule and
imported it into AD using ldifde:
export SUDOERS_BASE='OU=SUDOers,DC=example,DC=com'
./sudoers2ldif sudoers
dn: cn=defaults,OU=SUDOers,DC=example,DC=com
objectClass: top
objectClass: sudoRole
cn: defaults
description: Default sudoOption's go here
sudoOrder: 1
dn: cn=%administrators,OU=SUDOers,DC=example,DC=com
objectClass: top
objectClass: sudoRole
cn: %administrators
sudoUser: %administrators
sudoHost: ALL
sudoRunAsUser: ALL
sudoRunAsGroup: ALL
sudoCommand: ALL
sudoOrder: 2
and I am able to browse and edit these entries using ADSI Edit on a
Windows box that is joined to the domain.
My sssd.conf is as follows (I have had to improvise as I have not found
any solid documentation on how to do this using the new AD provider...):
[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = EXAMPLE.COM
debug_level = 6
[nss]
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
filter_groups = root
[pam]
[sudo]
[domain/EXAMPLE.COM]
debug_level = 6
# rely on POSIX attributes defined in Active Directory
ldap_id_mapping = false
ldap_schema = ad
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
sudo_provider = ldap
cache_credentials = true
# enable classic behavior of getent passwd
enumerate = true
ad_hostname = host01.example.com
ad_domain = example.com
krb5_server = example.com
krb5_kpasswd = example.com
krb5_realm = EXAMPLE.COM
ldap_referrals = false
ldap_schema = rfc2307bis
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
ldap_sasl_mech = GSSAPI
ldap_sudo_search_base = OU=SUDOers,DC=example,DC=com
Also nsswitch.conf is updated by default during the sssd install on
Debian jessie:
sudoers: files sss
I then restart sssd and clear the cache:
service sssd stop; rm -f /var/lib/sss/db/*; service sssd start
and then attempt to use sudo which fails. Here is the relevent part of
the sssd_EXAMPLE.COM.log file:
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_sudo_refresh_connect_done] (0x0400): SUDO LDAP connection successful
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_sudo_load_sudoers_next_base] (0x0400): Searching for sudo rules
with base [OU=SUDOers,DC=example,DC=com]
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=host01)(sudoHost=host01.example.com)(sudoHost=192.168.0.21)(sudoHost=192.168.0.0/24)(sudoHost=fe80::786b:f4ff:fe87:3314)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*\\*)(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))][OU=SUDOers,DC=example,DC=com].
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]] [be_run_online_cb]
(0x0080): Going online. Running callbacks.
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]] [read_pipe_handler]
(0x0400): EOF received, client finished
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]] [sdap_get_tgt_recv]
(0x0400): Child responded: 0 [FILE:/var/lib/sss/db/ccache_EXAMPLE.COM],
expired on [1386682572]
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]] [sdap_cli_auth_step]
(0x0100): expire timeout is 900
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]] [sasl_bind_send]
(0x0100): Executing sasl bind mech: GSSAPI, user: EXAMPLEDOC01$
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]] [fo_set_port_status]
(0x0100): Marking port 389 of server 'dc01.example.com' as 'working'
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[set_server_common_status] (0x0100): Marking server 'dc01.example.com'
as 'working'
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]] [fo_set_port_status]
(0x0400): Marking port 389 of duplicate server 'dc01.example.com' as
'working'
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[objectclass=domain][DC=example,DC=com].
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[objectclass=domain][DC=example,DC=com].
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no
errmsg set
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_get_users_process] (0x0400): Search for users, returned 0 results.
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_get_groups_next_base] (0x0400): Searching for groups with base
[DC=example,DC=com]
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(objectclass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][DC=example,DC=com].
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no
errmsg set
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_sudo_load_sudoers_process] (0x0400): Receiving sudo rules with
base [OU=SUDOers,DC=example,DC=com]
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_sudo_refresh_load_done] (0x0400): Received 0 rules
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sysdb_sudo_purge_byfilter] (0x0400): No rules matched
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_sudo_refresh_load_done] (0x0400): Sudoers is successfuly stored in
cache
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_sudo_full_refresh_done] (0x0400): Successful full refresh of sudo
rules
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_sudo_schedule_refresh] (0x0400): Full refresh scheduled at: 1386668172
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_sudo_schedule_refresh] (0x0400): Smart refresh scheduled at:
1386647472
(Mon Dec 9 21:36:12 2013) [sssd[be[EXAMPLE.COM]]]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no
errmsg set
It appears that it is not even pulling down the rules at all based on
the Received 0 rules line.
Is my config bad? Is there a 'right' way to get this working using the
AD provider?
Aaron Johnson
9 years, 6 months
sssd uid on broken ldap implementation
by Ben Morrice
Hello,
I am trying to use sssd in our environment where unfortunately we have a
broken ldap implementation with no options to fix it.
We have an openldap implementation where our 'uid' field can contain
many attributes, some containing a 'uid' and others containing
'uid@functional-unit'. Some users have in their ldap account a single
'uid@functional-unit' whereas others have 'uid' and potentially many
'uid@functional-unit'.
sssd does the right thing for most cases with multiple attributes; just
providing the first returned attribute (which is 'uid'). However I am
experiencing problems with users that have only a 'uid@functional-unit'
entry.
I want to configure sssd so that both 'uid' and 'uid@functional-unit'
are represented from sssd as 'uid'
Please see below for some examples of what i'm talking about and my
current configuration.
[~]$ getent passwd user1
user1:*:90001:20010:user1:/home/user1:/bin/bash
[~]$ getent passwd |grep user2
user2@functional-unit:*:85010:20010:user2:/home/user2@functional-unit:/bin/bash
[~]$
Note: I can't do a 'getent passwd user2' or 'getent passwd
user2@functional-unit' - neither options work.
I want to be able to 'getent passwd user2' and see no reference of the
'functional-unit'.
Current sssd config (i'm using sssd-1.9.2-129.el6.x86_64 on RHEL6);
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss
domains = default
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
override_homedir = /home/%u
allowed_shells = /bin/bash
shell_fallback = /bin/bash
[pam]
reconnection_retries = 3
[domain/default]
re_expression =
(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))
debug_level = 2
enumerate = true
cache_credentials = true
use_fully_qualified_names = false
id_provider = ldap
access_provider = ldap
auth_provider = krb5
chpass_provider = none
entry_cache_timeout = 5400
entry_cache_user_timeout = 1800
entry_cache_group_timeout = 5400
min_id = 1000
ldap_uri = ldap://ldap.example.com
ldap_search_base =
c=com?sub?(&(objectClass=posixAccount)(|(memberOf=group-1)(memberOf=group-2)))
krb5_realm = EXAMPLE.COM
krb5_server = example.com
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15
krb5_ccachedir = /tmp
I have been trying to address this issue with various permutations of
re_expression but seem to be failing miserably. If anyone has any
suggestions it would be most appreciated!
--
Kind regards,
Ben Morrice
______________________________________________________________________
Ben Morrice | e: ben.morrice(a)epfl.ch | t: +41-21-693-9670
EPFL - Quartier de l’innovation, Bât. J, 3ème étage, CH-1015 Lausanne, SWITZERLAND
9 years, 6 months