(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_access_send] (0x0400): Performing access check for user [br@domain.dk]
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_access_filter_send] (0x0400): Performing access filter check for user [br@domain.dk]
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_access_filter_send] (0x0400): Checking filter against LDAP
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_print_server] (0x2000): Searching 216.239.32.58:636
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=br)(objectclass=posixAccount)(memberOf=cn=vpn,ou=groups,dc=domain,dc=dk))][uid=br,ou=Users,dc=domain,dc=dk].
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 12
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_op_add] (0x2000): New operation 12 timeout 6
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_process_result] (0x2000): Trace: sh[0x5646f7c363a0], connected[1], ops[0x5646f7f1ffa0], ldap[0x5646f7c37e00]
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_op_destructor] (0x2000): Operation 12 finished
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_access_filter_done] (0x0100): User [br@domain.dk] was not found with the specified filter. Denying access.
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_access_filter_done] (0x0400): Access denied by online lookup
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sysdb_ldb_msg_difference] (0x2000): Added attr [ldap_access_filter_allow] to entry [name=br@domain.dk,cn=users,cn=domain.dk,cn=sysdb]
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sysdb_set_entry_attr] (0x0200): Entry [name=br@domain.dk,cn=users,cn=domain.dk,cn=sysdb] has set [cache, ts_cache] attrs.
(Tue May 10 07:43:02 2022) [be[domain.dk]] [sdap_access_done] (0x0400): Access was denied.
Am Mon, May 09, 2022 at 01:54:00PM +0200 schrieb Bo Riis Toelberg Kristensen:
> Hi
>
> I'm trying to authenticate users based on group membership in our Google
> LDAP directory.
> I can authenticate just fine without the 'ldap_access_filter' but when I
> enable it they still authenticate even when the user is not a group member.
> Additionally I don't see any check of the group membership in the logs, so
> I must be doing something wrong. Please help me.
>
> My sssd.conf
>
> *[sssd]services = nss, pamdomains = domain.dk
> <http://domain.dk>[domain/domain.dk <http://domain.dk>]# Base
> settingsdebug_level = 8id_provider = ldapauth_provider =
> ldapaccess_provider = ldapldap_access_order = filterldap_id_use_start_tls =
> trueldap_uri = ldaps://ldap.google.com
> <http://ldap.google.com>ldap_search_base =
> dc=domain,dc=comldap_user_search_base =
> ou=Users,dc=domain,dc=comldap_group_search_base =
> ou=Groups,dc=domain,dc=comldap_tls_cert =
> /etc/sssd/google-ldap-client.crtldap_tls_key =
> /etc/sssd/google-ldap-client.key# Disable TLS 1.3 of google LDAP don't
> workldap_tls_cipher_suite = NORMAL:!VERS-TLS1.3# Access
> controlldap_access_filter = (memberOf=CN=vpn,ou=Groups,dc=domain,dc=com)#
> Google recommended settingsldap_schema = rfc2307bisldap_user_uuid =
> entryUUID*
>
> I have been looking for any lines in the logs referencing my vpn group but
> there is none. I have even tried switching to 'auth_provider = simple' but
> there is no reference of the group check
Hi,
I do not seen anything obviously wrong in your sssd.conf. 'auth_provider
= simple' does not exists only 'access_provider = simple'. With PAM
authentication and authorization are different steps, 'auth' and 'acct'
in the related PAM configuration. Are you sure pam_sss is configured in
the 'acct' section?
Would it be possible to send logs with 'debug_level = 9' in the [pam]
and [domain/...] section of sssd.conf?
bye,
Sumit
>
> Regards
> Supergoof
>
> --
> ----CEGO A/S will as part of your communication and interaction with us
> collect and process personal data about you. You can read more about our
> collection and processing of your personal data and your rights as a data
> subject at https://cego.dk/gdpr <https://cego.dk/gdpr>/
> _______________________________________________
> sssd-users mailing list -- sssd-users@lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
_______________________________________________
sssd-users mailing list -- sssd-users@lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
E-mail: | brtk@cego.dk |
---|---|