Hi,
this is our sssd.conf
[sssd]
domains = fsmpi.rwth-aachen.de
config_file_version = 2
services = nss, pam
[pam]
offline_credentials_expiration = 1
offline_failed_login_attempts = 3
offline_failed_login_delay = 0
[domain/fsmpi.rwth-aachen.de]
ad_domain = fsmpi.rwth-aachen.de
krb5_realm = FSMPI.RWTH-AACHEN.DE
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
enumerate = true
ldap_user_fullname = displayName
krb5_lifetime = 48h
krb5_renewable_lifetime = 200h
krb5_renew_interval = 30m
ad_gpo_access_control = disabled
ldap_search_base =
dc=fsmpi,dc=rwth-aachen,dc=de?subtree?(&(!(objectClass=computer))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
in sssd_nss.log
(Wed Sep 18 14:40:38 2019) [sssd[nss]] [sss_dp_get_reply] (0x0010):
The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
(Wed Sep 18 14:41:08 2019) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider
returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
(Wed Sep 18 14:41:38 2019) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider
returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
Best regards
Rikus
> Sumit Bose <sbose(a)redhat.com> hat am 16. September 2019 18:01 geschrieben:
>
>
> On Mon, Sep 16, 2019 at 10:37:11AM +0200, Hinrikus Wolf wrote:
> > Hi,
> >
> >
> > > Sumit Bose <sbose(a)redhat.com> hat am 16. September 2019 08:23
geschrieben:
> > > Hi,
> > >
> > > I guess you mean that the users are still available for nss, i.e they
> > > can be looked up with 'getent passwd username'?
> > Yes, that's what I mean.
> >
> > >
> > > I think you didn't answer if you already tried to run the search
filter
> > > with '!(userAccountControl:1.2.840.113556.1.4.803:=2)' manually
with the
> > > ldapsearch command. This is important to understand if the search filter
> > > does not work at all or SSSD does not handle it properly.
> >
> > The filter works. I just in case tried it again with ldapsearch but we are using
this filter for several applications which are supporting ldap.
>
> Hi,
>
> I tried the ldap_search_base you've sent earlier (adopted to my setup)
> and it worked as expected, i.e. disabled users are not shown.
>
> Can you share your complete sssd.conf (sanitized if needed) and if
> possible the sssd_nss.log and the domain log both with debug_level=9?
>
> bye,
> Sumit
> >
> > Best regads
> > Rikus
> >
> > >
> > > bye,
> > > Sumit
> > > >
> > > > But may be it is not posible?
> > > >
> > > > Best regards
> > > > Rikus
> > > >
> > > > >
> > > > > LS
> > > > > _______________________________________________
> > > > > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > > > > To unsubscribe send an email to
sssd-users-leave(a)lists.fedorahosted.org
> > > > > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > > List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste...
> > > > >
> > > >
> > > >
> > > > --
> > > > Hinrikus Wolf
> > > >
> > > > Fachschaft Mathematik/Physik/Informatik
> > > > an der RWTH Aachen
> > > >
> > > > Telefon:
> > > > Karmanstr: +49 241 80 94506 Infozentrum: +49 241 80 26741
> > > > fs(a)fsmpi.rwth-aachen.de
https://www.fsmpi.rwth-aachen.de
> > > > _______________________________________________
> > > > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > > > To unsubscribe send an email to
sssd-users-leave(a)lists.fedorahosted.org
> > > > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste...
> > > _______________________________________________
> > > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste...
> > _______________________________________________
> > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste...
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste...