I understand what we're doing isn't supported and horrible practice. We are replacing the insecure LDAP server very soon.
I set ldap_uri = ldap://BLAH in sssd.conf and seems to be working despite expired cert. Though there are some error messages I would like to resolve.
As you can see sdap_access_host does grant access to accounts with the host attribute:
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP'
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'BLAH' as 'working'
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'BLAH as 'working'
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler] (0x0100): Got request with the following data
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): domain: LDAP
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): user: sysadmin
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): service: sshd
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): tty: ssh
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): ruser:
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): rhost: proxy
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 0
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): newauthtok type: 0
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): priv: 1
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): cli_pid: 11864
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): logon name: not set
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [sdap_access_host] (0x0100): Access granted for [CLIENT]
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>) [Success]
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sending result [0][LDAP]
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sent result [0][LDAP]
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler] (0x0100): Got request with the following data
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): domain: LDAP
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): user: sysadmin
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): service: sshd
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): tty: ssh
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): ruser:
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): rhost: proxy
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 0
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): newauthtok type: 0
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): priv: 1
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): cli_pid: 11864
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): logon name: not set
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [sdap_access_host] (0x0100): Access granted for [CLIENT]
Though right before the above successful login we see:
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'BLAH as 'working'
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'BLAH' as 'working'
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [sdap_get_generic_op_finished] (0x0040): Unexpected result from ldap: Protocol error(2), paged results cookie is invalid
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [5]: Input/output error
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [sdap_get_users_done] (0x0040): Failed to retrieve users
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [sdap_dom_enum_ex_users_done] (0x0040): User enumeration failed: 5: Input/output error
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [be_ptask_done] (0x0040): Task [enumeration]: failed with [5]: Input/output error
Does this mean that enumeration occurs not with SSSD but NSS?