On 09/07/2016 08:16 AM, Ondrej Valousek wrote:
The config you have does not make any sense, really.
Obviously you have id_mapping turned on - in this case SSSD ignores any RFC2307
attributes in AD - including loginshell.
If you want SSSD to honour RFC2307 attrs in AD, you need to turn ldap_id_mapping off.
That statement is incorrect. ID mapping *only* applies to UID and GID. SSSD will
still use the loginShell *if it is actually set*. If it's not set, then it will
just use the default_shell... which is explicitly set to /sbin/nologin.
More below.
-----Original Message-----
From: faktoriyel [mailto:faktoriyel@yahoo.com]
Sent: Wednesday, September 07, 2016 1:06 PM
To: sssd-users(a)lists.fedorahosted.org
Subject: [SSSD-users] SSSD and Active Directory loginShell and unixHomeDirectory caching
problem.
Hi Guys.
This is my first question in this mailing list and I already apologize for the missing
info and logs . I use rhel 7.2 server and try the login from A.D with pam.. These are my
sssd version info
sssd-common-pac-1.13.0-40.el7.x86_64
sssd-krb5-1.13.0-40.el7.x86_64
python-sssdconfig-1.13.0-40.el7.noarch
sssd-client-1.13.0-40.el7.x86_64
sssd-krb5-common-1.13.0-40.el7.x86_64
sssd-ad-1.13.0-40.el7.x86_64
sssd-ldap-1.13.0-40.el7.x86_64
sssd-proxy-1.13.0-40.el7.x86_64
sssd-common-1.13.0-40.el7.x86_64
sssd-ipa-1.13.0-40.el7.x86_64
sssd-1.13.0-40.el7.x86_64
I have successfully join to A.D. with net ads join and start sssd service . here is my
sssd.conf file
[sssd]
config_file_version = 2
services = nss, pam
domains = xxx.local
[nss]
shell_fallback = /sbin/nologin
allowed_shells = /bin/bash,/bin/sh
default_shell = /sbin/nologin
filter_groups = root
filter_users = root
[domain/default]
cache_credentials = False
ldap_enumeration_refresh_timeout = 600
ldap_purge_cache_timeout = 600
[domain/yurticikargo.local]
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad
ad_server = xx01.xx.local,xx03.xx.local
ad_domain = xx.local
ldap_krb5_keytab = /etc/krb5.keytab
ldap_krb5_init_creds = true
ldap_idmap_range_size = 100000000
ldap_idmap_range_max = 2000200000
ldap_schema = ad
cache_credentials = False
ldap_enumeration_refresh_timeout = 600
ldap_purge_cache_timeout = 600
ldap_user_shell = loginShell
after that when I check with getent any user account. I get correct info from active
directory especially abont loginShell and unixHomeDirectory field. I change login method
to sss and login with ssh everything is fine but when I logout and re-login user
loginShell and unixHomeDirectory info dissappear and I fall the nologin shell.
After clean sssd cache file and fresh start sssd
getent passwd xxxx
xxxx:*:1101569237:1101586812:xxxxx:/home/applicationadmins:/bin/bash
after ssh login logout with xxxx user
getent passwd xxxx
xxxx:*:1101569237:1101586812:xxxx:/:/sbin/nologin
I think sssd doesn't cache iloginShell and unixHomeDirectory info from A.D. and
when I login first time write cache some info doesn't include this information. When I
re-login it gets info from cache files and dosen't find loginshell etc. And then I
fall the nologin shell. Is tihs a bug? or am I missing something.?
SSSD actually *only* returns data from the cache; never directly. (When the
cache is empty, we go to LDAP, update the cache, then we retrieve the cached
contents to return).
It certainly sounds like something is causing the cache to be *overwritten*,
though, which is quite odd. In this case, we really need debug logs to make any
sense of it.
Please read
https://fedorahosted.org/sssd/wiki/Troubleshooting for details.