Does access work from any RHEL/CentOS client? (I’m asking because as long as those are
fully patched, all HBAC-related bugs should be fixed there)
There was a bug that we fixed in commit 88f6d8ad4eef4b4fa032fd451ad732cf8201b0bf in the
sssd-1-13 branch that should help.
However, that commit was not released as we didn’t release a 1.13.5 tarball yet (we
should, but there are some pending regressions, see the pagure milestone for details).
I think in the meantime the best way is to file an Ubuntu bug and ask the maintainer to
apply 88f6d8ad4eef4b4fa032fd451ad732cf8201b0bf
There should be no backporting necessary, the patch should apply cleanly.
On 7 Oct 2017, at 00:37, Orion Poplawski <orion(a)nwra.com>
wrote:
I just added my first ubuntu 16.04 client to our IPA domain and am having
problem with HBAC rules randomly denying access to a user that should have
access. Users are in AD (
ad.nwra.com), I have an external group containing
the AD user linked to an IPA group used for the HBAC rule. Much of the time
it will work, but sometimes not.
sssd.conf:
[
domain/nwra.com]
cache_credentials = True
krb5_auth_timeout = 30
krb5_store_password_if_offline = True
ipa_domain =
nwra.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
chpass_provider = ipa
ipa_server =
ipa.nwra.com, _srv_
ldap_tls_cacert = /etc/ipa/ca.crt
dns_discovery_domain =
nwra.com
timeout = 20
debug_level = 5
[sssd]
services = nss, sudo, pam, ssh, autofs
domains =
nwra.com
default_domain_suffix =
ad.nwra.com
debug_level = 5
This is with 1.13.4-1ubuntu1.8
Is there any hope for this version to work? Any reliable source for an
updated package?
--
Orion Poplawski
Technical Manager of NWRA Systems 720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion(a)nwra.com
Boulder, CO 80301
https://www.nwra.com/
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org