On Tue, Mar 15, 2016 at 08:41:40PM -0000, Josh England wrote:
I have sssd doing authentication through ldap and I actually have a
working configuration that uses access_provider=ldap and ldap_access_filter and does the
right thing on CentOS 6.4. On another system (CentOS 6.7) the exact same configuration
does not work. Access is granted at all times no matter what. In fact, I can put in
access_provider=deny, and access is still granted. Is there some dependency that I got
right on the first system that is incorrect on this one? I can post logs if needed.
Relevant info for non-working system:
Hi,
I'm sorry, but I can't reproduce this locally. I tried with git master
from source and ipa id_provider together with deny access provider and I
was denied access as I would expect.
Also, in the logs I see:
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [be_req_set_domain] (0x0400): Changing
request domain from [ipa.test] to [ipa.test]
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [be_pam_handler] (0x0100): Got request
with the following data
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): command:
SSS_PAM_ACCT_MGMT
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): domain:
ipa.test
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): user:
admin
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): service:
su-l
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): tty: pts/1
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): ruser:
jhrozek
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): rhost:
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): authtok
type: 0
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): newauthtok
type: 0
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): priv: 0
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): cli_pid:
7244
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [pam_print_data] (0x0100): logon name:
not set
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [be_pam_handler_callback] (0x0100):
Backend returned: (0, 6, <NULL>) [Success]
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [be_pam_handler_callback] (0x0100):
Sending result [6][ipa.test]
(Wed Mar 16 08:42:16 2016) [sssd[be[ipa.test]]] [be_pam_handler_callback] (0x0100):
Sent result [6][ipa.test]
What do you see in /var/log/secure or the journal with your config? Is
pam_sss present in the pam stack's account stack?