Hi, Will

I have already double checked and yes you are right. My mistake, not "ldap_filter" just "ldap_access_filter" was right. I have checked my first config with "id_provider = ad" with no luck. So GSSAPI + access_provider = ldap are the necessary parts of my config. Now everything is working as expected.
Thank you, Jakub, Will.

Here are the working solution:

[sssd]
  config_file_version = 2
  domains = example.com
  services = nss, pam

[nss]
  override_shell = /bin/bash
  override_homedir = /home/%d/%u

[domain/msk.i-teco.ru]
  access_provider = ldap
  auth_provider = ad
  chpass_provider = ad
  id_provider = ad
  ldap_access_order = filter, expire
  ldap_account_expire_policy = ad
  ldap_sasl_mech = GSSAPI
  ldap_sasl_authid = TESTLINUX$@EXAMPLE.COM
  ldap_schema = ad
  ldap_referrals = false
  ldap_id_mapping = true
  ldap_force_upper_case_realm = true
  ldap_access_filter = memberOf=CN=Linux Admins,OU=Common Groups,DC=example,DC=com
  cache_credentials = false

Best regards,
Vladimir Akhmarov

On 08.08.2013, at 19:32, Will_Darton@navyfederal.org wrote:

Shouldn't that be ldap_access_filter = memberOf=cn=Linux Admins,OU=Common Groups,DC=example,DC=com
/* -----------------------------
Will Darton



<sssd-users-bounces@lists.fedorahosted.org> wrote on 08/08/2013 10:24:59 AM:

> From: Jakub Hrozek <jhrozek@redhat.com>

> To: <sssd-users@lists.fedorahosted.org>,
> Date: 08/08/2013 10:25 AM
> Subject: Re: [SSSD-users] id_provider ad and ldap_filter issue
> Sent by: <sssd-users-bounces@lists.fedorahosted.org>
>
> On Thu, Aug 08, 2013 at 05:02:42PM +0400, Vladimir Akhmarov wrote:
> > Hi, Jakub
> >
> > Thanks for your reply. I have changed domain section according to
> your words. No success. Now I cannot even log on to the system via SSH.
> >
> > [root@testlinux ~]# cat /etc/sssd/sssd.conf
> > [sssd]
> >   config_file_version = 2
> >   domains = example.com
> >   services = nss, pam
> >   debug_level = 0x2000
> >
> > [nss]
> >   override_shell = /bin/bash
> >   override_homedir = /home/%d/%u
> >   debug_level = 0x2000
> >
> > [pam]
> >   debug_level = 0x2000
> >
> > [domain/example.com]
> >   id_provider = ad
> >   access_provider = ldap
> >   ldap_access_order = filter, expire
> >   ldap_account_expire_policy = ad
> >   access_provider = ldap
> >   ldap_sasl_mech = GSSAPI
> >   ldap_sasl_authid = TESTLINUX$@EXAMPLE.COM
> >   auth_provider = ad
> >   chpass_provider = ad
> >   ldap_schema = ad
> >   ldap_referrals = false
> >   ldap_id_mapping = true
> >   ldap_force_upper_case_realm = true
> >   ldap_filter = memberOf=cn=Linux Admins,OU=Common Groups,DC=example,DC=com
> >   cache_credentials = false
> >   debug_level = 0x2000
> >
> > [root@testlinux ~]# ssh domainuser@127.0.0.1
> > domainuser@127.0.0.1's password:
> > Connection closed by 127.0.0.1
> >
> > And again log files are attached
> >
> >
>
>
>
>
>
>
>
> >
> >
> > Best regards,
> > Vladimir Akhmarov
> >
> > On 08.08.2013, at 13:41, Jakub Hrozek <jhrozek@redhat.com> wrote:
> >
> > > On Thu, Aug 08, 2013 at 12:45:31PM +0400, Vladimir Akhmarov wrote:
> > >> Hello,
> > >>
> > >> I have a strange problem using new "id_provider = ad" and
> "ldap_filter = memberOf=cn=Linux Admins,OU=Common
> Groups,DC=example,DC=com" option. The problem is that I always can
> log on to the system no matter the user is member of the ldap_filter
> group or not. I want to filter out all domain users except those
> that are member of special group named "Linux Admins". Please help
> me to resolve this issue. In the attachment there are sssd logs.
> > >>
> > >> Here are some technical info:
> > >>
> > >> Active Directory 2008 R2
> > >> CentOS 6.4
> > >>
> > >> [root@testlinux ~]# uname -a
> > >> Linux testlinux 2.6.32-358.14.1.el6.x86_64 #1 SMP Tue Jul 16
> 23:51:20 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
> > >>
> > >> [root@testlinux ~]# sssd --version
> > >> 1.9.2
> > >>
> > >> [root@testlinux ~]# cat /etc/krb5.conf
> > >> [logging]
> > >> default = FILE:/var/log/krb5libs.log
> > >> kdc = FILE:/var/log/krb5kdc.log
> > >> admin_server = FILE:/var/log/kadmind.log
> > >>
> > >> [libdefaults]
> > >> default_realm = EXAMPLE.COM
> > >> dns_lookup_realm = true
> > >> dns_lookup_kdc = true
> > >> ticket_lifetime = 24h
> > >> renew_lifetime = 7d
> > >> forwardable = true
> > >> default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-
> sha1-96 arcfour-hmac
> > >> default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-
> sha1-96 arcfour-hmac
> > >> permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-
> sha1-96 arcfour-hmac
> > >>
> > >> [realms]
> > >> EXAMPLE.COM = {
> > >> }
> > >>
> > >> [domain_realm]
> > >> example.com = EXAMPLE.COM
> > >> .example.com = EXAMPLE.COM
> > >>
> > >> [root@testlinux ~]# cat /etc/samba/smb.conf
> > >> [global]
> > >>   workgroup = EXAMPLE
> > >>   realm = EXAMPLE.COM
> > >>   security = ads
> > >>   client signing = yes
> > >>   client use spnego = yes
> > >>   kerberos method = secrets and keytab
> > >>   password server = *
> > >>
> > >> [root@testlinux ~]# cat /etc/sssd/sssd.conf
> > >> [sssd]
> > >>  config_file_version = 2
> > >>  domains = example.com
> > >>  services = nss, pam
> > >>  debug_level = 0x2000
> > >>
> > >> [nss]
> > >>  override_shell = /bin/bash
> > >>  override_homedir = /home/%d/%u
> > >>  debug_level = 0x2000
> > >>
> > >> [pam]
> > >>  debug_level = 0x2000
> > >>
> > >> [domain/example.com]
> > >>  id_provider = ad
> > >>  access_provider = ad
> > >>  auth_provider = ad
> > >>  chpass_provider = ad
> > >>  ldap_schema = ad
> > >>  ldap_referrals = false
> > >>  ldap_id_mapping = true
> > >>  ldap_force_upper_case_realm = true
> > >>  ldap_filter = memberOf=cn=Linux Admins,OU=Common
> Groups,DC=example,DC=com
> > >>  cache_credentials = false
> > >>  debug_level = 0x2000
>
> Are you sure the user you are logging in as is a member of Linux Admins?
>
> Can you send another round of logs this time with debug_level = 7 ?
> _______________________________________________
> sssd-users mailing list
> sssd-users@lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-users

_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users