Hello,
I would like to change the search-filter for sssd because I created my own Group-Objectclass, but if I do a "getent group" I will not see my own group. My sssd.conf looks like this: ------------------ [sssd] config_file_version = 2 services = nss, pam domains = LDAP
[domain/LDAP] ldap_schema=rfc2307 ldap_uri = ldap://ldapserver.example.net:389 ldap_search_base=dc=example,dc=net ldap_default_bind_dn=uid=sssd-user,ou=users,dc=example,dc=net ldap_default_authtok=geheim id_provider=ldap auth_provider=ldap chpass_provider = ldap ldap_chpass_uri = ldap://ldapmaster.example.net:389 cache_credentials = True enumerate = true ldap_tls_cacertdir = /etc/ssl/zertifikate/demoCA ldap_tls_cacert = /etc/ssl/zertifikate/demoCA/cacert.pem ------------------
Everytime I do a "getent group" I see the following lines inside the log: ------------------ Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=1 BIND dn="uid=sssd-user,ou=users,dc=example,dc=net" mech=SIMPLE ssf=0 Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=1 RESULT tag=97 err=0 text=
Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=2 SRCH base="dc=example,dc=net" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))" ------------------- Is it possible to change the Filter: (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
If "yes" how can I do this? I read to many howtos but I could not find a solution.
Thanks for your help
Stefan --
On Thu, Nov 02, 2017 at 01:15:05PM +0100, Stefan Kania wrote:
Hello,
I would like to change the search-filter for sssd because I created my own Group-Objectclass, but if I do a "getent group" I will not see my own group. My sssd.conf looks like this:
[sssd] config_file_version = 2 services = nss, pam domains = LDAP
[domain/LDAP] ldap_schema=rfc2307 ldap_uri = ldap://ldapserver.example.net:389 ldap_search_base=dc=example,dc=net ldap_default_bind_dn=uid=sssd-user,ou=users,dc=example,dc=net ldap_default_authtok=geheim id_provider=ldap auth_provider=ldap chpass_provider = ldap ldap_chpass_uri = ldap://ldapmaster.example.net:389 cache_credentials = True enumerate = true ldap_tls_cacertdir = /etc/ssl/zertifikate/demoCA ldap_tls_cacert = /etc/ssl/zertifikate/demoCA/cacert.pem
Everytime I do a "getent group" I see the following lines inside the log:
Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=1 BIND dn="uid=sssd-user,ou=users,dc=example,dc=net" mech=SIMPLE ssf=0 Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=1 RESULT tag=97 err=0 text=
Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=2 SRCH base="dc=example,dc=net" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))"
Is it possible to change the Filter: (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
Does the ldap_group_object_class option help? See man sssd-ldap for details.
bye, Sumit
If "yes" how can I do this? I read to many howtos but I could not find a solution.
Thanks for your help
Stefan
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
Hello Sumit,
filter="(&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))"
Is it possible to change the Filter: (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
Does the ldap_group_object_class option help? See man sssd-ldap for details.
bye, Sumit
If "yes" how can I do this? I read to many howtos but I could not find a solution.
First Thing, I posted the wrong filter ^^ that's the filter for the users. The default filter for groups is: --------- (&(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))) ---------
What I need is: --------- (&(|(objectClass=stkaPosixGroup)(objectclass=PosixGroup))(cn=*)(&(gidNumber=*)(!(gidNumber=0)))) --------- If I set "ldap_group_object_class = stkaPosixGroup" sssd is using this filter: --------- (&(objectClass=stkaPosixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0)))) --------- So now the PosixGroup is missing. So this parameter will just override the default value. Because ldap_group_object_class must be a string and not a LDAP-filter it is not possible to put a filter as a value to this variable. I checked it :-)
Stefan
Thanks for your help
Stefan
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
On Thu, Nov 02, 2017 at 04:20:13PM +0100, Stefan Kania wrote:
Hello Sumit,
filter="(&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))"
Is it possible to change the Filter: (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
Does the ldap_group_object_class option help? See man sssd-ldap for details.
bye, Sumit
If "yes" how can I do this? I read to many howtos but I could not find a solution.
First Thing, I posted the wrong filter ^^ that's the filter for the users. The default filter for groups is:
(&(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0)))
What I need is:
(&(|(objectClass=stkaPosixGroup)(objectclass=PosixGroup))(cn=*)(&(gidNumber=*)(!(gidNumber=0))))
If I set "ldap_group_object_class = stkaPosixGroup" sssd is using this filter:
(&(objectClass=stkaPosixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))
So now the PosixGroup is missing. So this parameter will just override the default value. Because ldap_group_object_class must be a string and not a LDAP-filter it is not possible to put a filter as a value to this variable. I checked it :-)
I see, do both group types have common objectClass like e.g. 'top'? If yes you can use this objectClass in ldap_group_object_class and set a filter with stkaPosixGroup and posixGroup with the ldap_group_search_base option, see man sssd-ldap for details as well.
HTH
bye, Sumit
Stefan
Thanks for your help
Stefan
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
If using own objectclass, I would think you will use custom attributes ?
ldap_group_member = *hMemberDN* ldap_user_member_of = *description*
Thanks
On 11/02/2017 08:15 AM, Stefan Kania wrote:
Hello,
I would like to change the search-filter for sssd because I created my own Group-Objectclass, but if I do a "getent group" I will not see my own group. My sssd.conf looks like this:
[sssd] config_file_version = 2 services = nss, pam domains = LDAP
[domain/LDAP] ldap_schema=rfc2307 ldap_uri = ldap://ldapserver.example.net:389 ldap_search_base=dc=example,dc=net ldap_default_bind_dn=uid=sssd-user,ou=users,dc=example,dc=net ldap_default_authtok=geheim id_provider=ldap auth_provider=ldap chpass_provider = ldap ldap_chpass_uri = ldap://ldapmaster.example.net:389 cache_credentials = True enumerate = true ldap_tls_cacertdir = /etc/ssl/zertifikate/demoCA ldap_tls_cacert = /etc/ssl/zertifikate/demoCA/cacert.pem
Everytime I do a "getent group" I see the following lines inside the log:
Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=1 BIND dn="uid=sssd-user,ou=users,dc=example,dc=net" mech=SIMPLE ssf=0 Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=1 RESULT tag=97 err=0 text=
Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=2 SRCH base="dc=example,dc=net" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))"
Is it possible to change the Filter: (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))
If "yes" how can I do this? I read to many howtos but I could not find a solution.
Thanks for your help
Stefan
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
Am 02.11.2017 um 17:00 schrieb Mario Rossi:
If using own objectclass, I would think you will use custom attributes ?
ldap_group_member = *hMemberDN* ldap_user_member_of = *description*
This is what I did now. Let's put everything together what I did:
1. I created my own ObjectClasses ----------------- objectclass (1.3.6.1.4.1.23456.1.2.1 NAME 'stkaPosixGroup' DESC 'advanced PosixGroup for dynamic use' SUP top AUXILIARY MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ description ) )
objectclass (1.3.6.1.4.1.23456.1.2.2 NAME 'stkaPosixAccount' DESC 'advanced PosixAccount for dynamic use' SUP posixAccount AUXILIARY MAY ( memberUID )) ----------------- (YES I know that the ODI is not my ODI. It's just a test!
Then I created a group: ---------------- dn: cn=dynposix,ou=groups,dc=example,dc=net cn: dynposix gidNumber: 5000 objectClass: groupOfURLs objectClass: stkaPosixGroup objectClass: top memberURL: ldap:///dc=example,dc=net?memberUID?sub?(title=admin) ----------------
I create every user like this one: ---------------- dn: uid=a1,ou=users,dc=example,dc=net loginShell: /bin/bash homeDirectory: /home/a1 gidNumber: 10000 uid: a1 cn: anwender 1 uidNumber: 10007 sn: 1 givenName: anwender objectClass: posixAccount objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: stkaPosixAccount memberUid: a1 title: admin ----------------
Now every user with this configuration will become member in my group "dynposix"
Then I configured sssd: ---------------- [sssd] config_file_version = 2 services = nss, pam domains = LDAP
[nss] filter_groups = root filter_users = root reconnection_retries = 3
[pam] reconnection_retries = 3 offline_credentials_expiration = 2 offline_failed_login_attempts = 3 offline_failed_login_delay = 5
[domain/LDAP] ldap_schema=rfc2307 ldap_uri = ldap://ldapserver.example.net:389 ldap_search_base=dc=example,dc=net ldap_default_bind_dn=uid=sssd-user,ou=users,dc=example,dc=net ldap_default_authtok=geheim id_provider=ldap auth_provider=ldap chpass_provider = ldap ldap_chpass_uri = ldap://ldapserver.example.net:389 cache_credentials = True enumerate = true ldap_tls_cacertdir = /etc/ssl/zertifikate/demoCA ldap_tls_cacert = /etc/ssl/zertifikate/demoCA/cacert.pem ldap_purge_cache_timeout = 10 ldap_enumeration_refresh_timeout = 5 ldap_group_object_class = stkaPosixGroup ----------------
Because now sssd is only looking for groups with the objectClass stkaPosixGroup I'm adding the ObjectClass to every Posixgroup. So sssd will find all groups.
Now I can give my dynamic group permissions inside the filesystem and the memberlist is dynamic.
The only problem I have is that it takes several minutes until the changes inside the LDAP-Database will be seen by sssd. So it take several minutes until "getent group" is showing the changes :-(
Mayby someone can give me a hint where to look to get it faster.
But I think it would be a good idea to be capable of changing the filter. Stefan
On Thu, Nov 02, 2017 at 07:06:59PM +0100, Stefan Kania wrote:
Am 02.11.2017 um 17:00 schrieb Mario Rossi:
If using own objectclass, I would think you will use custom attributes ?
ldap_group_member = *hMemberDN* ldap_user_member_of = *description*
This is what I did now. Let's put everything together what I did:
- I created my own ObjectClasses
objectclass (1.3.6.1.4.1.23456.1.2.1 NAME 'stkaPosixGroup' DESC 'advanced PosixGroup for dynamic use' SUP top AUXILIARY MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ description ) )
objectclass (1.3.6.1.4.1.23456.1.2.2 NAME 'stkaPosixAccount' DESC 'advanced PosixAccount for dynamic use' SUP posixAccount AUXILIARY MAY ( memberUID ))
(YES I know that the ODI is not my ODI. It's just a test!
Then I created a group:
dn: cn=dynposix,ou=groups,dc=example,dc=net cn: dynposix gidNumber: 5000 objectClass: groupOfURLs objectClass: stkaPosixGroup objectClass: top memberURL: ldap:///dc=example,dc=net?memberUID?sub?(title=admin)
I create every user like this one:
dn: uid=a1,ou=users,dc=example,dc=net loginShell: /bin/bash homeDirectory: /home/a1 gidNumber: 10000 uid: a1 cn: anwender 1 uidNumber: 10007 sn: 1 givenName: anwender objectClass: posixAccount objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: stkaPosixAccount memberUid: a1 title: admin
Now every user with this configuration will become member in my group "dynposix"
Then I configured sssd:
[sssd] config_file_version = 2 services = nss, pam domains = LDAP
[nss] filter_groups = root filter_users = root reconnection_retries = 3
[pam] reconnection_retries = 3 offline_credentials_expiration = 2 offline_failed_login_attempts = 3 offline_failed_login_delay = 5
[domain/LDAP] ldap_schema=rfc2307 ldap_uri = ldap://ldapserver.example.net:389 ldap_search_base=dc=example,dc=net ldap_default_bind_dn=uid=sssd-user,ou=users,dc=example,dc=net ldap_default_authtok=geheim id_provider=ldap auth_provider=ldap chpass_provider = ldap ldap_chpass_uri = ldap://ldapserver.example.net:389 cache_credentials = True enumerate = true ldap_tls_cacertdir = /etc/ssl/zertifikate/demoCA ldap_tls_cacert = /etc/ssl/zertifikate/demoCA/cacert.pem ldap_purge_cache_timeout = 10 ldap_enumeration_refresh_timeout = 5 ldap_group_object_class = stkaPosixGroup
Because now sssd is only looking for groups with the objectClass stkaPosixGroup I'm adding the ObjectClass to every Posixgroup. So sssd will find all groups.
Now I can give my dynamic group permissions inside the filesystem and the memberlist is dynamic.
The only problem I have is that it takes several minutes until the changes inside the LDAP-Database will be seen by sssd. So it take several minutes until "getent group" is showing the changes :-(
Mayby someone can give me a hint where to look to get it faster.
But I think it would be a good idea to be capable of changing the filter. Stefan
I think there were some threads earlier about specifying a list of objectclasses in the "ldap_group_object_class" but as you found this is not implemented yet. Feel free to file a ticket.
In the meantime, there is a bit undocumented (and I think on purpose, because I guess specifying the list of classes would be a more systematic solution) option ldap_group_object_class_alt which lets you select an alternative objectclass and sssd would then look for either.
I think this was added where we found some inconsistencies between what objectclasses different IPA releases use some time ago and we had to implement some fix soon :-)
sssd-users@lists.fedorahosted.org