On 02/17/2013 11:33 AM, Michael Ströder wrote:

HI!

We're running Debian systems with old sssd 1.2.1 shipped in Debian Squeeze. This works most of the times with getent passwd and getent group together with uncached sudo-ldap data. So the data is in place and can be correctly retrieved by sssd via LDAP.

Since this old sssd version has some problems and does not have SUDO support we're looking at upgrading to 1.9.4.

My colleague prepared back-ported Debian packages of 1.9.4 I'm testing with.

But I'm struggling that groups are not correctly retrieved - see my last attempt of sssd.conf attached.

1. After login id does not show the user's groups although the OpenLDAP logs

show that group entries are searched and returned to sssd by OpenLDAP's slapd.

2. sudo -l -U username does not work although the OpenLDAP logs show that

sudoRole entries are searched and returned to sssd by OpenLDAP's slapd.

I wonder whether https://fedorahosted.org/sssd/ticket/1664 is relevant in my case but playing with several values for filter_users_in_groups and enumerate did not help.

Ciao, Michael.

Have you tried without enumeration? Does it work for you?

---

sssd-users mailing list sssd-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

On 02/17/2013 05:33 PM, Michael Ströder wrote:

HI!

We're running Debian systems with old sssd 1.2.1 shipped in Debian Squeeze. This works most of the times with getent passwd and getent group together with uncached sudo-ldap data. So the data is in place and can be correctly retrieved by sssd via LDAP.

Since this old sssd version has some problems and does not have SUDO support we're looking at upgrading to 1.9.4.

My colleague prepared back-ported Debian packages of 1.9.4 I'm testing with.

But I'm struggling that groups are not correctly retrieved - see my last attempt of sssd.conf attached.

1. After login id does not show the user's groups although the OpenLDAP logs

show that group entries are searched and returned to sssd by OpenLDAP's slapd.

2. sudo -l -U username does not work although the OpenLDAP logs show that

sudoRole entries are searched and returned to sssd by OpenLDAP's slapd.

I wonder whether https://fedorahosted.org/sssd/ticket/1664 is relevant in my case but playing with several values for filter_users_in_groups and enumerate did not help.

Ciao, Michael.

Hi, can you raise debug level in nss, sudo and domain section to 9 (put debug_level = 9 in [nss], [sudo] and [domain/yourdomain] sections in sssd.conf? What does the logs say?

Thanks, Pavel.

On Wed, Feb 20, 2013 at 08:23:04AM +0100, Michael Ströder wrote:

Pavel Březina wrote:

...

...

But I'm struggling that groups are not correctly retrieved - see my last attempt of sssd.conf attached.

1. After login id does not show the user's groups although the OpenLDAP logs

show that group entries are searched and returned to sssd by OpenLDAP's slapd.

can you raise debug level in nss, sudo and domain section to 9 (put debug_level = 9 in [nss], [sudo] and [domain/yourdomain] sections in sssd.conf? What does the logs say?

It turned out to be a bug in our own Debian package. The lib memberof.so was not found.

Now I'm still working on getting sudoers to work via sssd. But that's another story...

Glad the issue was resolved! Feel free to ping this list again if you can't get the sudo integration working. Please note you need relatively recent sudo built with the --with-sssd (not sure if Debian would do that even in -unstable/-testing)

On Wed, Feb 20, 2013 at 09:39:26PM +0100, Michael Ströder wrote:

Jakub Hrozek wrote:

...

Feel free to ping this list again if you can't get the sudo integration working. Please note you need relatively recent sudo built with the --with-sssd (not sure if Debian would do that even in -unstable/-testing)

Aah, this is a good hint where to look. And yes, I couldn't get it to work under Debian Squeeze.

Could you please provide the minimum sudo version required?

Ciao, Michael.

I believe that any 1.8.x version would do, but as I said, the sudo must be configured with --with-sssd.

Also, I'm not sure from the top of my head how the debian packaging looks like, but you'd also need to have the sssd's sudo plugin installed. On Fedora the plugin belongs to libsss_sudo package and is stored at /usr/lib{,64}/libsss_sudo.so

Jakub Hrozek wrote:

On Wed, Feb 20, 2013 at 09:39:26PM +0100, Michael Ströder wrote:

...

Jakub Hrozek wrote:

...

Feel free to ping this list again if you can't get the sudo integration working. Please note you need relatively recent sudo built with the --with-sssd (not sure if Debian would do that even in -unstable/-testing)

Aah, this is a good hint where to look. And yes, I couldn't get it to work under Debian Squeeze.

Could you please provide the minimum sudo version required?

I believe that any 1.8.x version would do, but as I said, the sudo must be configured with --with-sssd.

Also, I'm not sure from the top of my head how the debian packaging looks like, but you'd also need to have the sssd's sudo plugin installed. On Fedora the plugin belongs to libsss_sudo package and is stored at /usr/lib{,64}/libsss_sudo.so

My colleague packaged recent sudo 1.8.6 with the required build option --with-sssd today and it simply seems to work. He will upload it to Debian repos.

I have to do some more cache tuning in sssd.conf to let it update the local cache of the sudoRole entries more quickly without getting too chatty.

Ciao, Michael.