On 10/07/2017 10:17 AM, Jakub Hrozek wrote:
Does access work from any RHEL/CentOS client? (I’m asking because as
long as those are fully patched, all HBAC-related bugs should be fixed there)
Yeah, all of our EL6/7 machines are working fine. This is the first Ubuntu
machine I've had to deal with.
There was a bug that we fixed in commit
88f6d8ad4eef4b4fa032fd451ad732cf8201b0bf in the sssd-1-13 branch that should help.
However, that commit was not released as we didn’t release a 1.13.5 tarball yet (we
should, but there are some pending regressions, see the pagure milestone for details).
I think in the meantime the best way is to file an Ubuntu bug and ask the maintainer to
apply 88f6d8ad4eef4b4fa032fd451ad732cf8201b0bf
There should be no backporting necessary, the patch should apply cleanly.
Thanks for the info. I'll see what I can do.
> On 7 Oct 2017, at 00:37, Orion Poplawski <orion(a)nwra.com>
wrote:
>
> I just added my first ubuntu 16.04 client to our IPA domain and am having
> problem with HBAC rules randomly denying access to a user that should have
> access. Users are in AD (
ad.nwra.com), I have an external group containing
> the AD user linked to an IPA group used for the HBAC rule. Much of the time
> it will work, but sometimes not.
>
> sssd.conf:
> [
domain/nwra.com]
> cache_credentials = True
> krb5_auth_timeout = 30
> krb5_store_password_if_offline = True
> ipa_domain =
nwra.com
> id_provider = ipa
> auth_provider = ipa
> access_provider = ipa
> chpass_provider = ipa
> ipa_server =
ipa.nwra.com, _srv_
> ldap_tls_cacert = /etc/ipa/ca.crt
> dns_discovery_domain =
nwra.com
> timeout = 20
> debug_level = 5
>
> [sssd]
> services = nss, sudo, pam, ssh, autofs
> domains =
nwra.com
> default_domain_suffix =
ad.nwra.com
> debug_level = 5
>
>
> This is with 1.13.4-1ubuntu1.8
>
> Is there any hope for this version to work? Any reliable source for an
> updated package?
>
> --
> Orion Poplawski
> Technical Manager of NWRA Systems 720-772-5637
> NWRA, Boulder/CoRA Office FAX: 303-415-9702
> 3380 Mitchell Lane orion(a)nwra.com
> Boulder, CO 80301
https://www.nwra.com/
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
--
Orion Poplawski
Technical Manager of NWRA Systems 720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion(a)nwra.com
Boulder, CO 80301
https://www.nwra.com/