On (12/11/15 13:51), aaron wang wrote:
I'm configuring SSSD on a system to authenticate users against the LDAP
LDAP server side:
there are basically three options for the anonymous binding flag, 0 for
completely disallow anonymous binding, 1 allows anonymous binding, 2 allows
anonymous bind but allows only search operations on root DSE entry for
I'm providing the ldap_default_bind_dn and ldap_default_bind_authtok for
1) if admin changes the anonymous binding flag to "COMPLETELY DISALLOW" or
"ONLY ALLOW DSE", the authentication against LDAP server doesn't work
from the sssd log, the sssd has marked the LDAP server as "working", but
the sssd can't find the user in ldap
2) if admin sets anonymous binding flag to "ALLOW ANONYMOUS BINDING", the
authentication against LDAP server works
The only difference between test 1) and test 2) is the anonymous binding
I'm expecting that if I provide binding dn and binding password in the
sssd.conf, the server could turn off the anonymous completely or at least
partially. Is there an known issue around this ?
I assume (based on version) you use sssd on el6.4 or el6.5 which are quite old.
Could you test with 1.12.x?