On 7 October 2017 at 09:37, Orion Poplawski <orion(a)nwra.com> wrote:
I just added my first ubuntu 16.04 client to our IPA domain and am
having
problem with HBAC rules randomly denying access to a user that should have
access. Users are in AD (
ad.nwra.com), I have an external group
containing
the AD user linked to an IPA group used for the HBAC rule. Much of the
time
it will work, but sometimes not.
sssd.conf:
[
domain/nwra.com]
cache_credentials = True
krb5_auth_timeout = 30
krb5_store_password_if_offline = True
ipa_domain =
nwra.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
chpass_provider = ipa
ipa_server =
ipa.nwra.com, _srv_
ldap_tls_cacert = /etc/ipa/ca.crt
dns_discovery_domain =
nwra.com
timeout = 20
debug_level = 5
[sssd]
services = nss, sudo, pam, ssh, autofs
domains =
nwra.com
default_domain_suffix =
ad.nwra.com
debug_level = 5
This is with 1.13.4-1ubuntu1.8
Is there any hope for this version to work? Any reliable source for an
updated package?
You should check your sssd_domain logs (sssd_ad.nwra.com.log) for a time
when someone is being denied - search for hbac_eval_user_element and check
the number it returns versus the number of AD groups that user belongs to.
If the problem is that sssd isn't getting the right number of groups, then
updating to sssd version 1.15.3 will work.
I don't know if or where that's packaged for ubuntu, sorry.
I know it can be hard to reproduce, but if you can reproduce it, on the
client do:
- run the date command
- run the login unsuccessfully (if it is indeed hbac for login)
- run the date command.
Then check the IPA logs for entries between the dates.
Cheers
L.
------
"The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics
is the insistence that we cannot ignore the truth, nor should we panic
about it. It is a shared consciousness that our institutions have failed
and our ecosystem is collapsing, yet we are still here — and we are
creative agents who can shape our destinies. Apocalyptic civics is the
conviction that the only way out is through, and the only way through is
together. "
*Greg Bloom* @greggish
https://twitter.com/greggish/status/873177525903609857