On Mon, Jan 25, 2016 at 01:15:46PM -0000, steven.murdoch(a)cdk.com wrote:
Hi - I am new to SSSD and LDAP, and my first posting - so please bare with me.
# getent passwd only displays the local users - will not display the LDAP users and is
driving me insane - ldapsearch seems to work
I am using SSSD with TLS to authenticate to LDAP Server
The CA.crt files were self signed certificates.
I used # cacertdir_rehash to create to create the sym-link to the CA.crt on both Client
and Server
My LDAP Server hostname is 'ActDir-VM-Test'
My SSSD Client hostname is 'SSSD-VM-Test'
Here are my files:
Server - /etc/openldap/slapd.conf:
allow bind_v2
allow bind_anon_dn
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
TLSCACertificatePath /etc/openldap/cacerts
TLSCACertificateFile /etc/openldap/cacerts/CA.crt
TLSCertificateFile /etc/openldap/cacerts/server.crt
TLSCertificateKeyFile /etc/openldap/cacerts/server.key
TLSCipherSuite HIGH:MEDIUM:+TLSv1
TLSVerifyClient never
access to dn.sub="dc=vmlab,dc=ari,dc=cdk,dc=hosting"
by anonymous read
by * read
access to dn.base=""
by anonymous none
by * read
database config
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
manage
by * none
database monitor
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
read
by dn.exact="cn=Manager,dc=vmlab,dc=ari,dc=cdk,dc=hosting" read
by * none
access to * by users read
database bdb
suffix "dc=vmlab,dc=ari,dc=cdk,dc=hosting"
checkpoint 1024 15
rootdn "cn=Manager,dc=vmlab,dc=ari,dc=cdk,dc=hosting"
rootpw p@ssw0rd
loglevel 256
sizelimit unlimited
#
Server - ldap.conf:
TIMELIMIT 120
ssl start_tls
URI ldap://ActDir-VM-Test:389/
BASE cn=Manager,dc=vmlab,dc=ari,dc=cdk,dc=hosting
TLS_REQCERT allow
TLSCACertificatePath /etc/openldap/cacerts
TLSCACertificateFile /etc/openldap/cacerts/CA.crt
#
Server - /etc/sysconfig/ldap:
SLAPD_LDAP=yes
# Run slapd with -h "... ldapi:/// ..."
# yes/no, default: yes
SLAPD_LDAPI=no
# Run slapd with -h "... ldaps:/// ..."
# yes/no, default: no
SLAPD_LDAPS=no
#
Server - /etc/pam.d/password-auth-ac
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
#
Server: - /etc/pam.d/system-auth-ac
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
#
Server - /etc/nsswitch.conf
passwd: files sss
shadow: files sss
group: files sss
#
Client - /etc/sssd/sssd.conf:
[sssd]
services = nss, pam
config_file_version = 2
domains = vmlab
authconfig --enablesssd --enablesssdauth --enablelocauthorize --enableldap
--enableldaptls --enableldapauth
--ldapserver=ldap://ActDir-VM-Test.vmlab.ari.cdk.hosting:389
--ldapbasedn=dc=vmlab,dc=ari,dc=cdk,dc=hosting --disablekrb5 --disablenis
--enablerfc2307bis --enablemkhomedir --enablecachecreds --update
[domain/vmlab]
id_provider = ldap
auth_provider = ldap
# Timming
entry_cache_timeout = 600
ldap_network_timeout = 3
ldap_uri = ldap://ActDir-VM-Test.vmlab.ari.cdk.hosting:389
ldap_user_search_base = dc=ActDir-VM-Test,dc=vmlab,dc=ari,dc=cdk,dc=hosting
ldap_tls_reqcert = demand
cache_credentials = True
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_access_filter =
memberOf=CN=Manager,OU=Users,DC=ActDir-VM-Test,DC=vmlab,DC=ari,DC=cdk,DC=hosting
ldap_tls_cacert = /etc/openldap/cacerts/CA.crt
ldap_tls_reqcert = demand
ldap_default_bind_dn = cn=Manager,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
ldap_default_authtok_type = password
ldap_default_authtok = p@ssw0rd
enumerate = true
[nss]
filter_users = root, sshd, named, avahi, haldaemon, dbus, radiusd, news, nscd
filter_groups = root, sshd, named, avahi, haldaemon, dbus, radiusd, news, nscd
reconnection_retries = 3
entry_cache_timeout = 300
entry_cache_nowait_percentage = 75
debug_level = 6
[pam]
reconnection_retries = 3
#
The enumerate = True will only be enabled during testing - if I ever get it working -
then it will be removed.
Client - /etc/openldap/ldap.conf:
idle_timelimit 3600
TIMELIMIT 120
bind_timelimit 120
SASL_NOCANON on
TLSCACertificatePath /etc/openldap/cacerts
TLSCACertificateFile /etc/openldap/cacerts/CA.crt
#TLS_CACERTDIR /etc/openldap/cacerts
#TLS_CACERT /etc/openldap/cacerts/CA.crt
#TLS_CACERT /etc/openldap/cacerts/19913717.0
ssl start_tls
TLS_REQCERT allow
HOST ActDir-VM-Test.vmlab.ari.cdk.hosting
BASE dc=ActDir-VM-Test,dc=vmlab,dc=ari,dc=cdk,dc=hosting
URI ldap://ActDir-VM-Test.vmlab.ari.cdk.hosting:389
TLS_CACERTDIR /etc/openldap/cacerts
ldap_default_bind_dn cn=Manager,dc=vmlab,dc=ari,dc=cdk,dc=hosting
ldap_default_authtok p@ssw0rd
BINDDN uid=Manager,ou=Users,dc=ActDir-VM-Test,dc=vmlab,dc=ari,dc=cdk,dc=hosting
#
Client - the PAM files password-auth-ac and the system-auth-ac files are the same as the
Server:
Client - nsswitch.conf:
passwd: files sss
shadow: files sss
group: files sss
uid Manager
gid ldap
#base CN=vmlab,OU=Users,DC=vmlab,DC=ari,DC=cdk,DC=hosting
base DC=vmlab,DC=ari,DC=cdk,DC=hosting
uri ldap://ActDir-VM-Test.vmlab.ari.cdk.hosting
#
Client - ldapsearch:
# ldapsearch -x -ZZ -H ldap://ActDir-VM-Test.vmlab.ari.cdk.hosting -b
dc=vmlab,dc=ari,dc=cdk,dc=hosting objectclass=*
# extended LDIF
#
# LDAPv3
# base <dc=vmlab,dc=ari,dc=cdk,dc=hosting> with scope subtree
# filter: objectclass=*
# requesting: ALL
#
# vmlab.ari.cdk.hosting
dn: dc=vmlab,dc=ari,dc=cdk,dc=hosting
objectClass: dcObject
objectClass: organization
dc: vmlab
o: vmlab
# Users, vmlab.ari.cdk.hosting
dn: ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
objectClass: organizationalUnit
ou: Users
# Steve xxxxxxxxx, Users, vmlab.ari.cdk.hosting
dn: cn=Steve Murdoch,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
cn: Steve xxxxxxxx
sn: xxxxxxxx
objectClass: inetOrgPerson
The inetOrgPerson objectclass is not sufficient you need to add the
posixAccount objectclass to user objects and the posixGroup objects to
group objects. These objectclasses are needed to e.g. provided the POSIX
UIDs and GIDs.
HTH
bye,
Sumit
>
> userPassword:: cEBzc3cwcmQ=
> uid: sxxxxxxxx
>
> # Bob Jones, Users, vmlab.ari.cdk.hosting
> dn: cn=Bob Jones,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
> cn: Bob Jones
> sn: Jones
> objectClass: inetOrgPerson
> userPassword:: cEBzc3cwcmQ=
> uid: bjones
>
> # Tom xxxxxxxx, Users, vmlab.ari.cdk.hosting
> dn: cn=Tom xxxxxxxx,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
> cn: Tom xxxxxxxx
> sn: xxxxxxxx
> objectClass: inetOrgPerson
> userPassword:: cEBzc3cwcmQ=
> uid: txxxxxxxx
>
> # Max xxxxxxxx, Users, vmlab.ari.cdk.hosting
> dn: cn=Max xxxxxxxx,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
> cn: Max xxxxxxxx
> sn: xxxxxxxx
> objectClass: inetOrgPerson
> userPassword:: cEBzc3cwcmQ=
> uid: mxxxxxxxx
>
> # Platform, Users, vmlab.ari.cdk.hosting
> dn: cn=Platform,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
> cn: Platform
> objectClass: groupOfNames
> member: cn=Bob Jones,cn=Steve xxxxxxxx,cn=Tom xxxxxxxx,cn=Max xxxxxxxx,ou=Users
> ,dc=vmlab,dc=ari,dc=cdk,dc=hosting
> member: cn=Rod Stewart,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
> member: cn=Steve xxxxxxxx,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
> member: cn=Tom xxxxxxxx,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
>
> # mpitman, Users, vmlab.ari.cdk.hosting
> dn: uid=mxxxxxxxx,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
> cn: Mike xxxxxxxx
> sn: xxxxxxxx
> objectClass: inetOrgPerson
> userPassword:: cEBzc3cwcmQ=
> uid: mxxxxxx
>
> # root, Users, vmlab.ari.cdk.hosting
> dn: uid=root,ou=Users,dc=vmlab,dc=ari,dc=cdk,dc=hosting
> cn: root
> sn: root
> objectClass: inetOrgPerson
> userPassword:: cEBzc3cwcmQ=
> uid: root
>
> # search result
> search: 3
> result: 0 Success
>
> # numResponses: 10
> #
>
>
>
> Any help much appreciated - thanks a lot.
>
>
>
>
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org