SLAPD_LDAP=yes <-- previously disabled so no Start TLS via TCP 389 was allowed.
SLAPD_LDAPI=yes
SLAPD_LDAPS=yes
sssd.conf:
ldap_uri = ldap://provider
ldap_backup_uri = ldap://consumer
ldap_default_bind_dn = uid=woohoo,ou=topsecret,DN
ldap_default_authtok_type = password
ldap_default_authtok = toolongtocrack
ldap_search_base = DN
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/sha2bundle.cer
client sssd log:
(Tue Dec 13 12:20:39 2016) [sssd[be[LDAP]]] [simple_bind_send] (0x0100): Executing simple bind as: uid=woohoo,ou=topsecret,DN
(Tue Dec 13 12:20:39 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'provider' as 'working'
(Tue Dec 13 12:20:39 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'provider' as 'working'
provider /var/log/ldap:
Dec 13 12:25:58 suntzu slapd[2614]: => bdb_entry_get: found entry: "uid=woohoo,ou=topsecret,DN"
Dec 13 12:25:58 suntzu slapd[2614]: => bdb_entry_get: found entry: ""cn=custombindaccountpolicy,ou=policies,DN"
Dec 13 12:25:58 suntzu slapd[2614]: => access_allowed: auth access to "uid=woohoo,ou=topsecret,DN" "userPassword" requested
Dec 13 12:25:58 suntzu slapd[2614]: => acl_mask: access to entry ""uid=woohoo,ou=topsecret,DN, attr "userPassword" requested
Dec 13 12:25:58 suntzu slapd[2614]: conn=1004 op=1 BIND dn="uid=woohoo,ou=topsecret,DN" mech=SIMPLE ssf=0
I then did several ldapsearches with the account used for binding. The account's not locked out even though I supplied the wrong password each time.
I have halted both LDAP servers and it seems sssd cache with both autofs and my user / group attributes are working! However, I would like to be notified interactively that the LDAP servers are down. Can I have PAM let the user know upon login that the SSSD cache happens to be "active?"