-----Oprindelig meddelelse-----
Fra: Sumit Bose [mailto:sbose@redhat.com]
Sendt: 8. januar 2016 11:23
Til: End-user discussions about the System Security Services Daemon
Emne: [SSSD-users] Re: localauth plugin and some other questions
On Wed, Jan 06, 2016 at 01:11:50PM +0000, Longina Przybyszewska wrote:
>
> Thank you for the answers.
> There are still some issues:
>
>
> > > 2.
> > > I tried login with setup for UPN/sAMAccountName login- without
success.
> > > Is login with cross realm's UPN or short sAMAccoutName supported in
this
> > sssd version?
> > >
> > > In database for default domain cache_a.c.realm.db user object has
> > following names (for 'use_fully_qualified_names = true' setup):
> > >
> > > dn: name = user1(a)n.c.realm ...
> > > name: user1(a)n.c.realm
> > > nameAlias. user1(a)n.c.realm
> > > UserPrincipalName: user1@REALM
> > > canonicalUserPrincipalName: user1(a)N.C.REALM
> >
> > The plain sAMAccoutName 'user1' will not work because
> > use_fully_qualified_names = true. What should work is 'DOM\user1'
> > where DOM is the NetBIOS domain name of n.c.realm domain.
> > Additionally I would expect that user1@REALM should work.
> >
>
> Right. user1(a)n.c.realm and DOM\user1 login works.
>
> Login as user1@REALM (and user1@realm) does not work.
hm, that's odd, can you send me the logs when trying to login with
user1@REALM?
>
> getent passwd user1@realm
> user1@n.c.realm@a.c.realm:*:10002:30000000::/home/user1:/bin/bash
'user1@n.c.realm(a)a.c.realm' looks odd, do you map the user name to an
attribute other than sAMAccoutName?
I use " id_provider = ad" and do not map specifically user name to any
attribute..
Attributes in AD:
uid = user1
userPrincipalName = user1@realm
sAMAccountName = user1
SSSD defaults:
ldap_user_name = uid
ldap_user_principal = krbPrincipalName
krb5_use_enterprise_principal = true
There is no krbPrincipalName attribute in user object in AD .
Sssd.conf:
[nss]
debug_level = 9
filter_groups = root
filter_users = root
[sssd]
debug_level = 9
domains = a.c.realm
config_file_version = 2
services = nss, pam,ssh
[pam]
pam_verbosity = 3
debug_level = 9
[domain/a.c.realm]
debug_level = 9
ldap_use_tokengroup = false
dyndns_update = true
dyndns_update_ptr = true
id_provider = ad
access_provider = ad
auth_provider = ad
chpass_provider = ad
krb5_realm = A.C.REALM
krb5_use_fast = try
krb5_confd_path = /var/lib/sss/pubconf/krb5.include.d
ad_domain = a.c.realm
ad_site = SITE
ad_hostname = adm-lnx438.a.c.realm
use_fully_qualified_names = true
ldap_id_mapping = false
>
> The best would be able to login with sAMAccountName; The next best
> with upn, then with fqdn.
>
> I tried without success the following setup for login with short names :
> [nss]
> subdomain_inherit = ldap_user_principal
>
> [domain/a.c.realm]
> ..
> ldap_user_principal = sAMAccountName
this won't work because ldap_user_principal value is used as a Kerberos
principal without further processing.
You might want to try the 'default_domain_suffix' option, see man sssd.conf
for details.
Manual says, that 'default_domain_suffix' is usable if all users are
located in trusted domain while computer's are in primary domain.
With this option, users can login with short names.
Our users are in several trusted domains;
what should be the value of 'default_domain_suffix' ?
>
>
> > > 3.
> > > Localauth plugin:
> > > the option :
> > > krb5_confd_path = /var/lib/sss/pubconf/krb5.conf.d
> > >
> > > -does not create that directory (I understand from the doc that
> > > sssd should take care about it);
> >
> > no, SSSD expects the directory to be present, it should be create
> > during the package installation.
> >
> This is the content of /var/lib/sss/pubconf :
>
> ls /var/lib/sss/pubconf/
> kdcinfo A.C.REALM krb5.conf.d krb5.include.d
>
> 'krb5.conf.d' I have created manually ; After removing everything in
> /var/lib/sss/{db,mc,pubconf}/* and restarting sssd 'krb5.include.d'
disappeared.
yes, as said, SSSD does not create the directory for the krb5 config snippets.
>
> >
> > > [sssd[be[a.c.realm]]] [sss_write_domain_mappings] (0x0200):
> > > Mapping file for domain [a.c.realm] is
> > > [/var/lib/sss/pubconf/krb5.include.d/domain_realm_a_c_realm]
> > > [sssd[be[a.c.realm]]] [sss_write_domain_mappings] (0x0040):
> > > creating the
> > temp file
> > [/var/lib/sss/pubconf/krb5.include.d/domain_realm_a_c_realmU4PYcJ]
> > for domain-realm mappings failed.
> > > [sssd[be[a.c.realm]]] [sss_write_domain_mappings] (0x0080): Could
> > > not remove file
> >
[/var/lib/sss/pubconf/krb5.include.d/domain_realm_a_c_realmU4P<B0>]:
> > [2]: No such file or directory ....
> > > ls -ld
> > > drwxr-xr-x 2 root root 4096 Dec 16 16:08
> > > /var/lib/sss/pubconf/krb5.conf.d/
> >
> > It looks SSSD still tries the default location, did you put
> > krb5_confd_path in the right [domain/..] section?
> >
>
> Yes.
> ...
> [domain/a.c.realm]
> ...
> krb5_confd_path = /var/lib/sss/pubconf/krb5.conf.d
I still cannot reproduce this with my Fedora builds. Maybe it is an issue in the
Ubuntu build, I'll try to reproduce on Ubuntu.
I changed the krb5_confd_path = /var/lib/sss/pubconf/krb5.include.d and the localauth
snippet is written to it.
Longina