AUTO: William Darton is out of the office (returning 04/28/2014)
by Will_Darton@navyfederal.org
I am out of the office until 04/28/2014.
Note: This is an automated response to your message "Re: [SSSD-users]
timeout and offline mode behaviour" sent on 4/21/2014 10:05:58 AM.
This is the only notification you will receive while this person is away.
9 years, 12 months
Announcing SSSD 1.11.5
by Jakub Hrozek
=== SSSD 1.11.5 ===
The SSSD team is proud to announce the release of version 1.11.5 of
the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd
RPM packages will be made available for Fedora 19, 20 and rawhide shortly.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights ==
* This release focuses primarily on bug fixes.
* The release addresses an issue where the SSSD was not able to detect
all domains in the forest if it was connected to an AD DC which was not
the forest root
* A new AD sudo provider was introduced. Setting sudo_provider=ad uses
the same connection options as id_provider=ad, which simplifies the
configuration for users who store sudo rules on an Active Directory server.
* The ID mapping ranges are checked for collisions before being used,
making SSSD more robust in cases where the ranges would collide
* Password changes when using OTPs with an IPA server are now
supported. Please note that this functionality is not present in the
released FreeIPA versions yet.
* Several bugs related to setting an SELinux user context from an IPA
server were fixed
== Documentation Changes ==
* A new pam_sss option ignore_unknown_user was added. Setting this option
makes pam_sss return PAM_IGNORE when processing an uknown user instead of
PAM_USER_UNKNOWN. This option is mostly useful for BSD systems.
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/1955
SSSD pam module accepts usernames with leading spaces
https://fedorahosted.org/sssd/ticket/1958
[RFE] Expose the list of trusted domains to IPA
https://fedorahosted.org/sssd/ticket/2153
If both IPA and LDAP are set up with enumeration on, two enum tasks are running
https://fedorahosted.org/sssd/ticket/2218
sssd.conf man pages don't list a configuration option.
https://fedorahosted.org/sssd/ticket/2226
Make SSSD compilable on systems with non-standard paths to krb5 includes
https://fedorahosted.org/sssd/ticket/2232
[freebsd] pam_sss: add ignore_unknown_user option
https://fedorahosted.org/sssd/ticket/2235
MAN: Remove misleading memberof example from ldap_access_filter example
https://fedorahosted.org/sssd/ticket/2251
not retrieving homedirs of AD users with posix attributes
https://fedorahosted.org/sssd/ticket/2252
Document that `sssd` cache needs to be cleared manually, if ID mapping configuration changes
https://fedorahosted.org/sssd/ticket/2253
Check IPA idranges before saving them to the cache
https://fedorahosted.org/sssd/ticket/2256
Evaluate usage of sudo LDAP provider together with the AD provider
https://fedorahosted.org/sssd/ticket/2257
Setting int option to 0 yields the default value
https://fedorahosted.org/sssd/ticket/2263
ipa-server-mode: Use lower-case user name component in home dir path
https://fedorahosted.org/sssd/ticket/2264
SSSD Does not cache SELinux map from FreeIPA correctly
https://fedorahosted.org/sssd/ticket/2270
IPA SELinux code looks for the host in the wrong sysdb subdir when a trusted user logs in
https://fedorahosted.org/sssd/ticket/2271
sssd fails to handle expired passwords when OTP is used
https://fedorahosted.org/sssd/ticket/2279
Add another Kerberos error code to trigger IPA password migration
https://fedorahosted.org/sssd/ticket/2280
Double OK when starting the service
https://fedorahosted.org/sssd/ticket/2282
SSSD should create the SELinux mapping file with format expected by pam_selinux
https://fedorahosted.org/sssd/ticket/2284
Valgrind: Invalid read of int while processing netgroup
https://fedorahosted.org/sssd/ticket/2285
other subdomains are unavailable when joined to a subdomain in the ad forest
https://fedorahosted.org/sssd/ticket/2289
Error during password change
https://fedorahosted.org/sssd/ticket/2293
configure time variables not expanded when running ./configure
https://fedorahosted.org/sssd/ticket/2300
RHEL7 IPA selinuxusermap hbac rule not always matching
== Detailed Changelog ==
Alexey Shabalin (1):
* Use KRB5_CFLAGS where appropriate
Jakub Hrozek (16):
* Updating the version for the 1.11.5 release
* IPA: Don't call tevent_req_post outside _send
* IPA: Don't fail if apply_subdomain_homedir returns ENOENT
* OPTS: Allow using defaults for blobs
* DP: Provide separate dp_copy_defaults function
* MAN: Clarify the ldap_access_filter option further
* MAN: Clarify that changing ID mapping options might require purging the cache
* IPA: Do not save intermediate data to sysdb
* AD: Only connect to GC for subdomain users
* MAN: Clarify the GC support a bit
* IPA: Use the correct domain when processing SELinux rules
* IPA: Write SELinux usernames in the right case
* KRB5: Do not attempt to get a TGT after a password change using OTP
* AD: connect to forest root when downloading the list of subdomains
* IPA: Fix SELinux mapping order memory hierarchy
* Updating the translations for the 1.11.5 release
Lukas Slebodnik (10):
* SPEC: Use systemd on available platforms
* LDAP: Setup periodic task only once.
* UTIL: Sanitize whitespaces.
* DOC: Fix names of arguments in doxygen comments
* AD: Continue if sssd failes to check extra members
* SYSV: Do not call functions success and fail itself
* IPA: Use function sysdb_attrs_get_el in safe way
* Makefile: Add missing library to the dp_opt_tests
* TESTS: Link libsss_test_common with tevent
* Makefile: Use alternative method to replace *bindir
Michal Zidek (1):
* Possible null dereference in SELinux code
Nathaniel McCallum (1):
* Fix krb5 changepw when FAST-only preauth methods are used (like OTP)
Pete Fritchman (1):
* PAM: add ignore_unknown_user option
Stef Walter (1):
* providers: Fix types passed to dbus varargs functions
Sumit Bose (13):
* IDMAP: add sss_idmap_check_collision(_ex)
* IPA: refactor idmap code and add test
* IPA: check ranges for collisions before saving them
* libsss_idmap: bump version-info
* config API: add missing subdomain target to AD provider test
* SUDO: AD provider
* ipa-server-mode: use lower-case user name for home dir
* IPA: Use GC for AD initgroup requests
* IPA/KRB5: handle KRB5_PROG_ETYPE_NOSUPP during IPA password migration
* krb5_child: remove unused option lifetime_str from k5c_setup_fast()
* krb5-child: extract lifetime settings into set_lifetime_options()
* krb5_client: rename krb5_set_canonicalize() to set_canonicalize_option()
* krb5-child: add revert_changepw_options()
10 years
Substring searches on sudoHost
by Michael Ströder
HI!
I can see substring filters like this in my LDAP logs:
[..] (|(sudoHost=*\5C*)(sudoHost=*?*)(sudoHost=*\2A*)(sudoHost=*[*]*))))
(stripped the lenghty filter)
Is this sssd asking for sudoRole entries?
Ciao, Michael.
10 years
SSSD/LDAP User Authentication Problem
by J. Alexander Jacocks
All,
I have a somewhat weird issue with user authentication, with a pure LDAP
SSSD backend. A user was created in LDAP, and that user could be used, via
SSSD, for login, etc., just fine. Then, the LDAP databases were rebuilt
(this is a test environment) and the user was re-created, in LDAP, and can
be seen there.
HOWEVER, only hosts created SINCE the LDAP rebuild allow this user to
authenticate. Hosts that predate the rebuild respond with "user unknown".
I've gone through all the caches that I know (nscd, PAM), and haven't
managed to solve the problem.
Here is a log of what SSSD reports, when trying to authenticate the user,
from a host that predated the LDAP rebuild:
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting
info for [baduser] from [<ALL>]
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (4):
Requesting info for [baduser@default]
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [sss_dp_send_acct_req_create] (4):
Sending request for [default][4097][1][name=baduser]
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [sss_dp_get_reply] (4): Got reply
(0, 0, Success) from Data Provider
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (4):
Requesting info for [baduser@default]
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (2): No
results for getpwnam call
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting
info for [baduser] from [<ALL>]
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (2): User
[baduser] does not exist in [default]! (negative cache)
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (2): No
matching domain found for [baduser], fail!
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting
info for [baduser] from [<ALL>]
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (2): User
[baduser] does not exist in [default]! (negative cache)
(Thu Apr 17 13:35:51 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (2): No
matching domain found for [baduser], fail!
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [sss_cmd_get_version] (5): Received
client version [3].
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [sss_cmd_get_version] (5): Offered
version [3].
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_cmd_authenticate] (4): entering
pam_cmd_authenticate
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): command:
PAM_AUTHENTICATE
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): domain: (null)
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): user: baduser
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): service: sshd
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): tty: ssh
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): ruser: (null)
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): rhost: 1.2.3.4
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): authtok type: 1
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): authtok size:
13
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): newauthtok
type: 0
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): newauthtok
size: 0
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): priv: 1
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_print_data] (4): cli_pid: 3919
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [sss_dp_send_acct_req_create] (4):
Sending request for [default][3][1][name=baduser]
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [sss_dp_get_reply] (4): Got reply
(3, 17, Init Groups Failed) from Data Provider
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_check_user_dp_callback] (2):
Unable to get information from Data Provider
Error: 3, 17, Init Groups Failed
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_check_user_search] (4):
Requesting info for [baduser@default]
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_check_user_search] (2): No
matching domain found for [baduser], fail!
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_reply] (4): pam_reply get
called.
(Thu Apr 17 13:35:51 2014) [sssd[pam]] [pam_reply] (4): blen: 8
(Thu Apr 17 13:35:51 2014) [sssd[be[default]]] [be_get_account_info] (4):
Got request for [4097][1][name=baduser]
(Thu Apr 17 13:35:51 2014) [sssd[be[default]]] [sdap_save_user] (2): Failed
to save user [baduser]
(Thu Apr 17 13:35:51 2014) [sssd[be[default]]] [sdap_save_users] (2):
Failed to store user 0. Ignoring.
(Thu Apr 17 13:35:51 2014) [sssd[be[default]]] [acctinfo_callback] (4):
Request processed. Returned 0,0,Success
(Thu Apr 17 13:35:51 2014) [sssd[be[default]]] [be_get_account_info] (4):
Got request for [3][1][name=baduser]
(Thu Apr 17 13:35:51 2014) [sssd[be[default]]] [sdap_save_user] (2): Failed
to save user [baduser]
(Thu Apr 17 13:35:51 2014) [sssd[be[default]]] [acctinfo_callback] (4):
Request processed. Returned 3,17,Init Groups Failed
(Thu Apr 17 13:35:53 2014) [sssd[nss]] [client_recv] (5): Client
disconnected!
(Thu Apr 17 13:35:53 2014) [sssd[pam]] [client_recv] (5): Client
disconnected!
Any thoughts, based on this?
Thanks!
- Alex
10 years
(uidNumber=4294967295)
by Michael Ströder
HI!
I see lots of queries like this in the LDAP logs:
(&(uidNumber=4294967295)(objectClass=posixAccount))
Any clue why sssd asks for this non-existent uidNumber?
Ciao, Michael.
10 years
SSSD + autofs on Ubuntu/Mint
by Alexandre Beauclair
Greetings everyone!
I'm not sure if it's the right place to ask, but since it concerns SSSD, I thought I might give it a try!
I have an environment where servers are on CentOS, and workstations are on Linux Mint (Ubuntu). I am currently working on making the transition to Samba4 AD, and so far everything's going good. I'm at the point where I need to make SSSD automount users' home directories on login using the LDAP maps stored on Active Directory. I got it working on my CentOS servers, and thought (maybe naively) that I could use a somewhat similar configuration on our Mint workstations, but alas, what seems to work on CentOS doesn't seem to work on the workstations.
Now I know it is possible use SSSD to automount on Mint using LDAP-stored maps, as it is currently working on my live environment. However, the only difference I can see, is that on the live environment, the maps are stored using different attributes than on my test network. On the test network (Samba4), my LDAP maps use the nisMap, nisObject, nisMapName and nisMapEntry attributes, whereas on live it uses automountMap, automount, automountKey, automountMapName and the likes. Is it possible that Mint/Ubuntu doesn't like the nis* attributes? Do I have to use the automount* attributes? I have read that Samba4 ships with the nis* attributes builtin, and so thought it might be easier to get working than to use a different schema's attributes, but now I'm not so sure anymore, and I'm trying to make sense of it all.
Below is the config I am currently using (working on CentOS, but not on Mint/Ubuntu)
/etc/sssd/sssd.conf
[sssd]
services = nss, pam, autofs
config_file_version = 2
domains = default
debug_level = 5
[nss]
[pam]
[autofs]
# Added this line for Mint only, on CentOS it works without it.
ldap_autofs_search_base = CN=AutomountMaps,CN=Automount,DC=lant,DC=example,DC=pri
[domain/default]
id_provider = ldap
ldap_schema = rfc2307bis
ldap_referrals = false
ldap_uri = ldap://samba-master.lant.example.pri
ldap_search_base = dc=lant,dc=example,dc=pri
ldap_force_upper_case_realm = true
# See man sssd-simple
access_provider = simple
# Uncomment to check for account expiration in DC
# access_provider = ldap
# ldap_access_order = expire
# ldap_account_expire_policy = ad
# Enumeration is discouraged for performance reasons.
enumerate = true
auth_provider = krb5
chpass_provider = krb5
ldap_sasl_mech = gssapi
ldap_sasl_authid = samba-master$(a)LANT.EXAMPLE.PRI
krb5_realm = LANT.EXAMPLE.PRI
krb5_server = samba-master.lant.example.pri
krb5_kpasswd = samba-master.lant.example.pri
ldap_krb5_keytab = /etc/krb5.sssd.keytab
ldap_user_object_class = user
ldap_user_name = samAccountName
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_user_shell = loginShell
ldap_group_object_class = group
autofs_provider = ldap
ldap_krb5_init_creds = true
ldap_autofs_search_base = CN=AutomountMaps,CN=Automount,DC=lant,DC=example,DC=pri
ldap_autofs_map_object_class = nisMap
ldap_autofs_entry_object_class = nisObject
ldap_autofs_map_name = nisMapName
ldap_autofs_entry_key = cn
ldap_autofs_entry_value = nisMapEntry
/etc/nsswitch.conf (on Mint. Replace "compat" by "files" for CentOS)
passwd: compat sss
group: compat sss
shadow: compat
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis sss
automount: sss
The ldif I used for my maps on the Active Directory server:
container.ldif
dn: CN=Automount,DC=lant,DC=example,DC=pri
objectClass: top
objectClass: container
cn: Automount
distinguishedName: CN=Automount,DC=lant,DC=example,DC=pri
instanceType: 4
showInAdvancedViewOnly: TRUE
adminDisplayName: Automount
adminDescription: Automount
name: Automount
objectCategory: CN=Container,CN=Schema,CN=Configuration,DC=lant,DC=example,DC=pri
dn: CN=AutomountMaps,CN=Automount,DC=lant,DC=example,DC=pri
objectClass: top
objectClass: container
cn: AutomountMaps
distinguishedName: CN=AutomountMaps,CN=Automount,DC=lant,DC=example,DC=pri
instanceType: 4
showInAdvancedViewOnly: TRUE
name: AutomountMaps
objectCategory: CN=Container,CN=Schema,CN=Configuration,DC=lant,DC=example,DC=pri
auto.master.ldif
dn: CN=auto.master,CN=AutomountMaps,CN=Automount,DC=lant,DC=example,DC=pri
objectClass: top
objectClass: nisMap
cn: auto.master
name: auto.master
nisMapName: auto.master
dn: cn=/home/users/example,CN=auto.master,CN=AutomountMaps,CN=Automount,DC=lant,DC=example,DC=pri
objectClass: top
objectClass: nisObject
cn: /home/users/example
name: /home/users/example
nisMapName: auto.master
nisMapEntry: auto.home
auto.home.ldif
dn: CN=auto.home,CN=AutomountMaps,CN=Automount,DC=lant,DC=example,DC=pri
objectClass: top
objectClass: nisMap
cn: auto.home
name: auto.home
nisMapName: auto.home
dn: cn=*,CN=auto.home,CN=AutomountMaps,CN=Automount,DC=lant,DC=example,DC=pri
objectClass: top
objectClass: nisObject
cn: *
name: *
msSFU30Name: *
msSFU30NisDomain: lant
nisMapName: auto.home
nisMapEntry: -intr,user_xattr,dir_index,fsc samba-master.lant.example.pri:/home/users/example/&
I'm pretty stumped as to why it doesn't work on one OS but work on the other OS.
Thanks for any help you can provide!
Alexandre Beauclair
10 years
FreeIPA Training Series - FreeIPA 3.3 and SSSD 1.11
by Martin Kosek
Hello FreeIPA and SSSD users,
Our team just published FreeIPA&SSSD training presentations created in the
event of successful stabilization of FreeIPA 3.3 and SSSD 1.11 branches which
introduced a lot of AD Trust related enhancements and other bug fixes.
I uploaded all the presentations to FreeIPA.org site, see
http://www.freeipa.org/page/Documentation#FreeIPA_Training_Series
I would like to welcome you to look at the presentations, I hope they will help
you learn about the stuff we have been working on since the last Training
Series round released almost a year ago.
--
Martin Kosek <mkosek(a)redhat.com>
Supervisor, Software Engineering - Identity Management Team
Red Hat Inc.
10 years
Announcing SSSD 1.11.5.1
by Jakub Hrozek
=== SSSD 1.11.5.1 ===
The SSSD team is proud to announce the release of version 1.11.5.1 of
the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd
RPM packages will be made available for Fedora 19, 20 and rawhide shortly.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights ==
* Fixes an issue producing the systemd unit file while building from
the tarball.
* Fixes a regression that caused a segfault when connecting to a Samba 4
domain controller.
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/2311
sssd crashes after upgrade from 1.11.4 to 1.11.5 when using a samba4
domain
https://fedorahosted.org/sssd/ticket/2314
sssd-1.11.5-1.fc20 has wrong systmd service file
== Detailed Changelog ==
Jakub Hrozek (3):
* Updating the version for the 1.11.6 release
* Setting the version to 1.11.5.1 for the release
* Updating the translations for the 1.11.5.1 release
Lukas Slebodnik (1):
* AUTOMAKE: Do not include makefile generated files into tarball
Stephen Gallagher (1):
* AD Provider: Fix crash looking up forest on Samba 4
10 years
enumeration not working
by Angel Bosch
hi!
I'm having problems with enumerate = true
If i query single user with id <user> or getent passwd <user> i get a succesful response. but I can't get a full list with
getent group
or
getent passwd
I get this in log:
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1].
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1].
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [nss_cmd_setgrent_send] (0x0100): Received setgrent request
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [nss_cmd_getgrent] (0x0100): Requesting info for all groups
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [nss_cmd_getgrent] (0x0100): Requesting info for all groups
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [nss_cmd_endgrent] (0x0100): Terminating request info for all groups
(Mon Apr 7 13:05:42 2014) [sssd[nss]] [client_recv] (0x0200): Client disconnected!
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1].
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1].
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [nss_cmd_setpwent_send] (0x0100): Received setpwent request
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [nss_cmd_getpwent] (0x0100): Requesting info for all accounts
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [nss_cmd_getpwent] (0x0100): Requesting info for all accounts
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [nss_cmd_endpwent] (0x0100): Terminating request info for all accounts
(Mon Apr 7 13:05:46 2014) [sssd[nss]] [client_recv] (0x0200): Client disconnected!
this is my conf:
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = XXX.net
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
debug_level = 5
[pam]
reconnection_retries = 3
[domain/XXX.net]
enumerate = true
cache_credentials = true
debug_level = 5
min_id = 500
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_schema = rfc2307bis
ldap_uri = ldap://XXX.XXX.net
ldap_search_base = dc=example,dc=global
ldap_tls_reqcert = demand
# ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
ldap_tls_cacertdir = /etc/ssl/certs
some more info:
# sssd --version
1.9.2
# lsb_release -a
LSB Version: :base-4.0-ia32:base-4.0-noarch:core-4.0-ia32:core-4.0-noarch
Distributor ID: CentOS
Description: CentOS release 6.5 (Final)
Release: 6.5
Codename: Final
anyone facing same problem?
abosch
--
10 years