sssd-users May 2015

sssd-users@lists.fedorahosted.org

17 participants
14 discussions

sssd able to login the user but failed on sudo
by Karim 07 May '15

07 May '15

Hi Team, i have two forests both working fine in terms of authentication. I added a user to sudoers from one of the domains and he is getting access denied. the user is able to login with no problem, sudo is not working. in the secure log it shows "account is expired" in the SSSD logs it shows error "attempting to kinit for realm xxxxxx" then "clients credentials has been revoked" i checked the account and it is not expired nor locked. additionally: I have another account on the same forest which i used to join to the domain and it is working fine on both authentication and sudoers. I also tried ldap_user_principal = no suchattribute and krb5_use_enterprise_principal = false but the problem remains. what could be the reason behind being able to access and later getting clients credential revoked for sudoes? Thanks

4 11

does "ldap_access_order = host" support jokers ?
by Olivier 06 May '15

06 May '15

Hi everyone, I have been aware on this list about "access_provider" and "ldap_access_order" that I ignored (thank you again) and I'm know testing couple of things. I try to configure SSSD for host based access control (enabeling the behavior of pam_check_host_attr) and the following works for me : On the client side (hostname = gaia01.sandbox.example.fr), I added this to my sssd.conf: access_provider = ldap ldap_access_order = host ldap_user_authorized_host = host I have added the objectclass hostObject to my users on the ldap side and I see that : - if attribute host is not set in ldap for a user, then access to gaia01.sandbox.example.fr is refused - if attribute host is set for a user to gaia01.sandbox.example.fr then access is granted for that user on gaia01.sandbox.example.fr - if attribute host is set for a user to '*' then access is granted for that user on gaia01.sandbox.example.fr - if attribute host is set to anything else then access to gaia01.sandbox.example.fr is refused -> so far so good, that's what I (almost) expected. My problem know is that I would like to grant access to certain users to all hosts in the sandbox space. I tryed to set attribute host for a user to '*.sandbox.*' (I also tried '*sandbox*') and I see that access to gaia01.sandbox.example.fr is refused My question is : are jokers supported in the host attribute ? And the bonus question : if not, what would you recommend to tune user autorisations in ldap so that they can only log to all machines that contain a specific label in there hostname (or why not all hosts that are hosted in a specific network). Thanks, -- Olivier

2 5

LDAP Environment Variables lost on Ubuntu with Active Directory
by Simon 05 May '15

05 May '15

Hi, I have configured an Ubuntu 14.04 server to authenticate against, and use attributes from, Active Directory running on Server 2008 R2. However, I have a seemingly odd issue whereby user environment variables (which are initially set correctly) get lost on the second (or third) and then subsequent logins E.g. First login: Creating directory '/Users/domainuser'. domainuser@localhost:~$ pwd /Users/domainuser domainuser@localhost:~$ echo $HOME /Users/domainuser domainuser@localhost:~$ getent passwd domainuser domainuser:*:4000:3000:DomainUser:/Users/domainuser:/bin/bash domainuser@localhost:~$ exit Second (or third) login: $ pwd / $ echo $HOME / $ getent passwd domainuser domainuser:*:4000:3000:DomainUser:/: sssd.conf looks like this: [sssd] debug_level = 1 domains = example.com config_file_version = 2 services = nss, pam, sudo [nss] filter_groups = root,localadmin filter_users = root,localadmin [domain/example.com] # General Options debug_level = 1 id_provider = ad access_provider = ad use_fully_qualified_names = false cache_credentials = true case_sensitive = false # SSS-AD Options ad_domain = example.com # SSSD-KRB5 Options krb5_realm = EXAMPLE.COM realmd_tags = manages-system joined-with-samba # SSSD-LDAP Options ldap_schema = AD ldap_id_mapping = false ldap_idmap_range_min = 1000 ldap_idmap_range_max = 2145326679 ldap_search_base = dc=example,dc=com ldap_group_search_base = OU=Groups,DC=example,DC=com???CN=Users,DC=example,DC=com?? ldap_user_search_base = OU=Accounts,DC=example,DC=com ldap_group_object_class = group ldap_user_object_class = person ldap_group_modify_timestamp = whenChanged ldap_user_modify_timestamp = whenChanged ldap_user_home_directory = unixHomeDirectory ldap_user_principal = sAMAccountName ldap_user_name = sAMAccountName If anyone thinks they can shed any light on the matter I'd be most grateful. Thanks, -- Simon

3 3

can't get dyndns_update with "id_provider = ldap" to work...
by Torgeir.Wulfsberg＠kongsberg.com 05 May '15

05 May '15

Hi! I can't get "dyndns_update" to work when I have "ldap" as "id_provider". Having set "debug_level = 9", I do not see any "update add/delete" entries in my sssd logfile. Setting "ad" as "id_provider" solves this. Is this by design, or just the way it is supposed to work? Regards, Torgeir ________________________________ CONFIDENTIALITY This e-mail and any attachment contain KONGSBERG information which may be proprietary, confidential or subject to export regulations, and is only meant for the intended recipient(s). Any disclosure, copying, distribution or use is prohibited, if not otherwise explicitly agreed with KONGSBERG. If received in error, please delete it immediately from your system and notify the sender properly.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users May 2015