Hello everyone,
I am trying to get sssd configured with ldap but having a little bit of
trouble. I can successfully authenticate and get all user information and
all that basic jazz. However when I set pwdReset in the user's entry on our
ldap sssd is not prompting the user to reset their password. It's obvious
from the sssd log for the domain (part included below) that sssd sees the
attribute in the password policy control but the message is not making it
back to PAM.
I have also included the config for the domain including some of my
attempts to figure out if this is a configuration issue. Am I missing a
setting? Have I found a bug? Whats going on here?
- Seth
>>>> some Pertinent Versions
CentOS 6
sssd 1.12.2
openldap 2.4.39
>>>>>>>>>>>>>>>>>>>>>>>> auth-people log
[find_password_expiration_attributes] (0x4000): No password policy
requested.
[simple_bind_send] (0x0100): Executing simple bind as: *****
[simple_bind_send] (0x2000): ldap simple bind sent, msgid = 2
[sdap_process_result] (0x2000): Trace: sh[0x136a340], connected[1],
ops[0x1410460], ldap[0x1360050]
[sdap_process_result] (0x2000): Trace: ldap_result found nothing!
[sdap_process_result] (0x2000): Trace: sh[0x136a340], connected[1],
ops[0x1410460], ldap[0x1360050]
[sdap_process_message] (0x4000): Message type: [LDAP_RES_BIND]
[simple_bind_done] (0x2000): Server returned control
[1.3.6.1.4.1.42.2.27.8.5.1].
[simple_bind_done] (0x1000): Password Policy Response: expire [0] grace
[-1] error [Password must be changed].
[simple_bind_done] (0x1000): Password was reset. User must set a new
password.
[simple_bind_done] (0x0400): Bind result: Success(0), no errmsg set
[auth_bind_user_done] (0x4000): Found ppolicy data, assuming LDAP password
policies are active.
[sdap_handle_release] (0x2000): Trace: sh[0x136a340], connected[1],
ops[(nil)], ldap[0x1360050], destructor_lock[0], release_memory[0]
[remove_connection_callback] (0x4000): Successfully removed connection
callback.
[be_pam_handler_callback] (0x0100): Backend returned: (0, 12, <NULL>)
[Success]
[be_pam_handler_callback] (0x0100): Sending result [12][auth-people]
[be_pam_handler_callback] (0x0100): Sent result [12][auth-people]
>>>>>>>>>>>>>>>>>>>>> sssd.conf section for the domain
[domain/auth-people]
ldap_uri = ************
ldap_user_search_base = ou=people,**********
ldap_group_search_base = ou=group,**********
ldap_id_use_start_tls = True
ldap_tls_cacert = /etc/sssd/ca-certificate.pem
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
access_provider = ldap
selinux_provider = none
ldap_access_filter = (objectClass=posixAccount)
ldap_access_order = filter
debug_level = 0xFFF0
[sssd]
services = nss, pam
config_file_version = 2
domains = auth-people,auth-systemAccounts
debug = 0xFFF0
[nss]
debug_level = 0xFFF0
[pam]
debug_level = 0xFFF0
pam_verbosity = 2