On Fri, Sep 16, 2016 at 04:01:09PM +0200, Bernd Leibing wrote:
I'm using sssd 1.13.3 and try to configure sssd for nss and pam
both against our
openldap server. Nss seems to work but pam doesn't.
# getent passwd timap
timap:*:41848:400:Test Imap:/users/org1/timap:/usr/local/bin/bash
but login of the timap user fails:
syslog output:
login[2315]: pam_sss(login:auth): authentication failure; logname=LOGIN
uid=0 euid=0 tty=tty1 ruser= rhost= user=timap
login[2315]: pam_sss(login:auth): received for user timap: 7 (Authentication failure)
login[2315]: FAILED LOGIN 1 FROM tty1 FOR timap, Authentication failure
Maybe we have an unusal ldap server setup. There is a privileged DN
cn=roadmin,ou=people,ou=admin,dc=myorg,dc=de
to access all posixAccount objects.
a user Account has this attributes:
# ldapsearch -x -w secret -D "cn=roadmin,ou=people,ou=admin,dc=myorg,dc=de"
'(&(uid=timap)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))'
# extended LDIF
#
# LDAPv3
# base <ou=people,dc=myorg,dc=de> (default) with scope subtree
# filter:
(&(uid=timap)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))
# requesting: ALL
#
# timap, people, myorg.de
dn: uid=timap,ou=people,dc=myorg,dc=de
userPassword:: e0NSWVBUfSQ2JDV5N1B5RC84N3pRY2VmZlgkMk1LQjAxc1pFNzBzYXFsOUhZNWo
3WFhJSVZXOWMuTHdOZEZpMzV5UVpzYlN0ZGpLVDVhdVdKeWRlcVdBSDMySmhwanZMNGJkZnVhYXMy
SVFxVG41Yi8=
cn: timap
gecos: Test Imap
gidNumber: 400
homeDirectory: /users/org1/timap
loginShell: /usr/local/bin/bash
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
uid: timap
uidNumber: 41848
My configuration is
--------/etc/sssd/sssd.conf-------------------
[sssd]
config_file_version = 2
services = nss,pam
domains = LDAP
[nss]
filter_groups = root
filter_users = root
[pam]
pam_verbosity = 3
[domain/LDAP]
debug_level = 0xFFF0
ldap_uri = ldaps://ldapserver.myorg.de
ldap_search_base = dc=myorg,dc=de
ldap_schema = rfc2307
id_provider = ldap
ldap_id_use_start_tls = True
enumerate = False
cache_credentials = True
chpass_provider = ldap
auth_provider = ldap
ldap_tls_cacertdir = /var/ldap
ldap_tls_cacert = /var/ldap/certdb.pem
ldap_tls_reqcert = demand
ldap_default_bind_dn = cn=roadmin,ou=people,ou=admin,dc=myorg,dc=de
ldap_default_authtok_type = password
ldap_default_authtok = secret
---------------------------------------
--------/etc/nsswitch.conf-------------
passwd: files sss
group: files sss
shadow: files sss
hosts: files dns
---------------------------------------
Excerpt of sssd_LDAP.log:
[sssd[be[LDAP]]] [simple_bind_done] (0x0400): Bind result: Success(0), no errmsg set
[sssd[be[LDAP]]] [simple_bind_send] (0x0100): Executing simple bind as:
cn=roadmin,ou=people,ou=admin,dc=myorg,dc=de
[sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server
'ldapserver.myorg.de' as 'working'
[sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request for
[0x1001][FAST BE_REQ_USER][1][name=timap]
[sssd[be[LDAP]]] [be_req_set_domain] (0x0400): Changing request domain from
[LDAP] to [LDAP]
[sssd[be[LDAP]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
[sssd[be[LDAP]]] [sdap_search_user_next_base] (0x0400): Searching for users
with base [dc=myorg,dc=de]
[sssd[be[LDAP]]] [sdap_print_server] (0x2000): Searching xxx.xxx.xxx.xxx
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling
ldap_search_ext with
[(&(uid=timap)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][dc=myorg,dc=de].
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid]
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber]
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos]
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [homeDirectory]
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell]
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[krbPrincipalName]
[sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn]
[sssd[be[LDAP]]] [sdap_parse_entry] (0x1000): OriginalDN:
[uid=timap,ou=people,dc=myorg,dc=de].
[sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [userPassword]
[sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [cn]
[sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [gecos]
[sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [gidNumber]
[sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [homeDirectory]
[sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [loginShell]
[sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
[sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [uid]
[sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [uidNumber]
[sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimestamp]
[sssd[be[LDAP]]] [sdap_save_user] (0x2000): Adding originalDN
[uid=timap,ou=people,dc=myorg,dc=de] to attributes of [timap].
[sssd[be[LDAP]]] [sdap_save_user] (0x0400): Storing info for user timap
So far this looks good. nss is working, but the pam request not!
Pam is using an additional simple_bind as
uid=timap,ou=people,dc=myorg,dc=de
instead of directly authenticating against the hash of the timap
userPassword attribute we already got from the ldap request above
binding as 'self' is the only supported LDP authentication method in
SSSD, sorry.