org structure as user/group structure?
by Max Lock
Hi All,
I'm querying an AD server using LDAP lookups only. I can authenticate
a user just fine but the groups configured on the AD system aren't
relevant to what we're doing.
Looking at the the sssd-ldap man page, the ldap_group options look
like they may be used to modify the group lookups to look at user data
instead.
In each user record we have directReports: and manager: attributes.
Could these be used so that if Alice reports to Bob she's mapped to
the Bob group etc?
-Cheers Max.
The information contained in this email, including any attachments, is intended solely for use by the individual or entity named above and may be confidential. If you have received this email in error please delete it and notify the sender immediately; you should not retain the message or disclose its contents to anyone. Thank you. hibu (UK) Limited, One Reading Central, Forbury Road, Reading, Berkshire, RG1 3YL, registered in England No. 4205228. hibu Sales Limited, One Reading Central, Forbury Road, Reading, Berkshire, RG1 3YL, registered in England No. 1403041. VAT registered number: GB765346017 © hibu (UK) Limited 2013. All rights reserved. hibu and other ™ are trademarks of hibu (UK) Limited or its licensors.
9 years, 10 months
sssd with openldap and dynlist overlay
by Ansgar Jazdzewski
Hi,
i configured openldap to use the dynlist overlay, wite the uid into the
attr memberUid dependening on the result off an ldap filter (in attr
memberURL)
in slapd.conf:
---
overlay dynlist
dynlist-attrset posixGroup memberURL memberUid:uid
---
After set ldap deref threshold to 0 the groups are listed correct (getent
group -s sss) but with id the membership is not shown.
so something is wrong but i have no idea.
Thanks for your help
Ansgar
9 years, 10 months
using SSSD with nscd
by Daniel Jung
According to the redhat/fedora doc on this subject is to suggesting that
sssd is not meant to run with nscd but could be ran with nscd caching host
only and rest to sssd. Curious to hear of lists opinions on this setup.
Benefits of not runnig nscd at all and run sssd only and use no nscd at
all.
Cheers,
9 years, 10 months
setting sss_authorized_keys?
by Daniel Jung
According to the doc,
In order to manage user keys, SSSD has a tool, sss_ssh_authorizedkeys,
which performs two operations:
1. Retrieves the user's public key from the user entries in the Identity
Management (IPA) domain.
2. Stores the user key in a custom file, .ssh/sss_authorized_keys, in
the standard authorized keys format.
So i can get the sss_ssh_authorizedkeys to spit out the publickey, and can
auth using it via sshd, however, I do not see .ssh/sss_authorized_keys
being created under users directory. I even tried creating the file and see
if it gets updated.
Don't see anything obvious in the ssh_config that would indicate adding
authorized_keys.
Anyone?
9 years, 10 months
sss_ssh_authorizedkeys issues
by Daniel Jung
Hi,
I see that it was added in 2012 in Feb. So i assume version forward from
1.8.0 will support this?
I am running 1.9.2 on centos, installed from the centos repo.
I added ldap_user_ssh_public_key = sshPublicKey to my LDAP domain and i can
see it being loaded in the sss_LDAP.log after setting debug_level = 10
I tried doing creating [ssh] in hopes of getting more detailed log when
running sss_ssh_authorizedkeys ${id} but dont see anything ...
The error i get is "Error looking up public keys" I have sshPublicKey set
and can be queried using ldapsearch uid=${id} sshPublicKey
What am i overlooking?
Cheers
9 years, 10 months
Re: [SSSD-users] ddns updates not required?
by John Hodrien
On 7 Jun 2014 18:38, steve <steve(a)steve-ss.com> wrote:
> Hi
> Thanks.
> Yes, same here. Even though bind allows the signed updates from sssd, we
> don't need them. We can authenticate using sssd no matter what IP is
> assigned and no matter what is stored in AD. Maybe the ddns requirement
> could be removed from the default ad-backend?
You can hijack a keytab from another machine and use it for sssd, so correct DNS really doesn't matter for pure sssd operation. You'll only cause bother for things using kerberos auth as a service (say samba/http/NFS/SSH), which if you like such things is a big deal.
jh
9 years, 10 months
sssd basic questions
by Robert Zmijan
Hi
I want to setup sssd to use ldap_default_bind_dn and ldap_default_authok.
currently I have in my sssd.conf
ldap_default_bind_dn = cn=sssd,ou=services,dc=myhost,dc=net
ldap_default_authok = mypassword
I understand that I would have to put 'mypassword' in ldap under the
name of 'sssd'
the problem I'm facing is that when i type:
sss_obfuscate I get this:
File "/usr/sbin/sss_obfuscate", line 81
print "Cannot read internal configuration files"
/etc/sssd/sssd.conf is readable for everyone (rw- r-- r--)
I'm using Gentoo
Are there any other files sss_obfuscate needs access to?
The other question is regarding the ldap attributes sssd needs to have
access to in ldap database. I thought I would list those attributes in
my slapd.conf access list and grant the access to the 'sssd' user entry.
Is this a sensible way to configure sssd?
Thanks in advance
Robert
9 years, 10 months
ddns updates not required?
by steve
Hi
Samba4 DC with sssd clients.
It seems that ddns updates are not necessary for Linux against AD as no
check is made in dns before tickets are issued. In the hope that this
would simplify configuration, could anyone confirm this behaviour?
Thanks,
Steve
9 years, 10 months
timeout and offline mode behaviour
by Joschi Brauchle
Hello everone,
we have an issue/problem that seems highly related to the current
"timeout and offline mode behaviour".
We have several SSSD 1.9.5 systems with "cache_credentials = true",
which experience periodic blocking/pausing of the complete X session for
several seconds (~5-10) when these machines are not connected to their
home network. The user is not able to use the machine at all during
these lockups, which is very annoying...
These are some of the details:
1) The LDAP server has a local 192.168.x.x IP, which is resolvable globally.
2) The LDAP server is behind a firewall, dropping packets from outside
networks.
3) The lockups seem to occur if the clients are not connected to this
"home" network but to a different network with similar configuration
(192.168.x.x, which is pretty common).
I am still trying to track down the issue with "debug_level = 9" and get
the logs of such a lockup.
@Jakub:
Could you let me know which openLDAP version you are using and
suspecting to be the problem?
Could you let me know how to trigger/test the issue reliably (the DNS
setup you are using to trigger it)?
I would like to confirm that we are having the same or possibly
different problem...
Best regards,
Joschi Brauchle
9 years, 10 months
Announcing SSSD 1.12 beta 2
by Jakub Hrozek
=== SSSD 1.12 Beta 2 ===
The SSSD team is proud to announce the second beta release of version 1.12
of the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd.
RPM packages will be made available for Fedora rawhide shortly.
The SSSD 1.12.0 release is scheduled for the end of June. Our goal is
to stabilize the release and focus solely on bug fixes until the final
1.12.0 release. At the same time, the SSSD is string-frozen until the
release of 1.12.0.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights ==
* This releases merges the enhancements that were included in 1.11.6 and
stabilizes the strings before releasing 1.12.0. With this beta2, SSSD
enters a string freeze period before the final 1.12.0 release
* Several patches that improve portability of SSSD, especially with
consideration of BSD systems have been included
* The sss_usermod tool was enhanced to add or modify custom attributes
for entries in domains configured with id_provider=local. This feature
is mostly useful for testing the InfoPipe responder without having to
configure a remote server.
* Fixed unit tests on big-endian architectures
== Documentation Changes ==
* A new option ldap_use_tokengroups was added. Setting this option to False
disables the support for tokenGroups, which is useful for environments that
wish to restrict the group nesting level. Doing so with tokenGroups enabled
is nontrivial since the tokenGroups attribute flattens the group memberships.
* A new option homedir_substring makes it possible to substitute a
templatized home directory attribute for a client-side defined value
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/2182
[RFE] Add the possibility to add custom attributes for the local provider
https://fedorahosted.org/sssd/ticket/2308
document that simple access provider supports group nesting
== Detailed Changelog ==
Jakub Hrozek (6):
* Updating the version to 1.12beta2
* TOOLS: Allow adding and modifying custom attributes with sss_usermod
* TESTS: fgetc returns int, not char
* MAN: Fix a typo in the ldap_id_mapping page
* LDAP: Fix DEBUG message
* Updating the translations for the 1.12beta2 release
Lukas Slebodnik (14):
* UTIL: Add function sss_parse_name_const
* NSS: Refactor expand_homedir_template
* NSS: Add option to expand homedir template format
* TEST: Add test for expand homedir
* PAM: Include header file security/pam_appl.h
* MAKE: Remove PAM libraries from libsss_simple
* CONFIGURE: Enhance detection of pam
* PAM: Fix compilation of pam_test_client with openpam
* PAM: Use fallback version of some pam macros
* PAM: Define compatible macros for some functions.
* PAM: add ignore_authinfo_unavail option
* SDAP: Use portable constant as level in setsockopt
* Unify usage of function gethostname
* MAN: Add reference to manual page sssd-sudo
Pavel Březina (1):
* man: clarify refresh_expired_interval
Pavel Reichl (5):
* LDAP: fix - find primary group by gid
* MAN: Detailed ldap_group_nesting_level option
* SDAP: Make nesting_level = 0 to ignore nested groups
* SDAP: Add option to disable use of Token-Groups
* MAN: hint nested groups by simple access provider
9 years, 10 months