RHEL 6.4
sssd v1.11.6
Preface : I'm just recently absorbing sssd so I might be missing something here. I
assume that you can use the simple access provider with the ad id_provider.
In my domain section:
cache_credentials = true
id_provider = ad
auth_provider = ad
access_provider = simple
default_shell = /bin/bash
fallback_homedir = /home/%u
use_fully_qualified_names = false
ignore_group_members = true
And below I've tried a few things in the domain section:
simple_allow_users = bswift ---> this works!
simple_allow_groups = sjrb.lg.it.cfg.cdo --> this doesn't work :(
I'd really prefer to use the simple provider as it's just easier to configure. We
are using puppet as our config management tool so non-admins could submit pull requests
via git and they'd only have to know a simpler user API, and not understand SSSD or
LDAP queries.
Is this a deficiency in the version I'm using?
I found a post on this forum where setting "ldap_use_tokengroups = false" might
help, tried that.. didn't help.
debug_level = 7 gives me this log output (just the last few lines)
(Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_access_obtain_filter_lists]
(0x0200): Allow users list is empty.
(Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_access_obtain_filter_lists]
(0x0200): Deny users list is empty.
(Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_access_obtain_filter_lists]
(0x0200): Deny groups list is empty.
(Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_access_check_send] (0x0200): Simple
access check for bswift
(Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_check_get_groups_send] (0x1000):
Looking up groups for user bswift
(Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_check_get_groups_send] (0x0400):
User bswift is a member of 74 supplemental groups
(Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_check_get_groups_send] (0x0400):
All groups had name attribute
(Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_access_check_recv] (0x1000): Access
not granted
One thing that may be causing this is in AD under this group name, I see this:
"To enable access to this group for UNIX clients you will need to specify the NIS
domain this group belongs to." However the dropdown is empty (maybe access rights
as I'm not the domain admin).
Sometimes what you read on a windows box isn't the full truth.. maybe it is in this
case?
Any direction here would be appreciated.
Thanks!