[SSSD] sssd and kerberos.

Patrik Martinsson Patrik.Martinsson at smhi.se
Mon Aug 2 14:38:35 UTC 2010


Ok, thanks fior quick reply.

Changed to, sssd --debug-to-files instead. Barely nothing shows up in 
those logs, if i don't use it with the -d10 option.
Even thou -d10 is used, nothing is printed to the krb5_child.log, so i 
guess maybe the kerberos part is ok.

Here's the ldap part

ldap_uri = ldaps://xx:636
ldap_schema = rfc2307bis

ldap_search_base = DC=xx,DC=xxxx,DC=xx
ldap_user_search_scope = sub
ldap_user_search_base = ou=People,dc=xx,dc=xx,dc=xx
ldap_group_search_base = ou=Groups,dc=xx,dc=xx,dc=xx

ldap_user_object_class = person
ldap_user_name = cn
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = msSFUHomeDirectory
ldap_user_shell = loginShell
ldap_user_principal = userPrincipalName
ldap_user_gecos = mail

ldap_group_object_class = Group
ldap_group_name = cn
ldap_group_gid_number = msSFU30GidNumber
ldap_force_upper_case_realm = True

ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer
ldap_tls_cacertdir = /etc/openldap/cacerts

If i change, auth_provider to ldap instead of krb5 and add,
ldap_default_bind_dn = cn=xx,ou=People,dc=xx,dc=xx,dc=xx
ldap_default_authtok_type = password
ldap_default_authtok = xx

Then i got the expected result.
It's only when i change sssd to use krb authentication it fails.

Thanks again.

Best regards,
Patrik Martinsson, Sweden.



On 08/02/2010 04:13 PM, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 08/02/2010 10:06 AM, Patrik Martinsson wrote:
>    
>> Hello,
>>
>> I've successfully setup'ed sssd on our systems to connect to our
>> Microsoft AD with ldap
>> authentication, now i want to use kerberos instead, and have I of course
>> ran into some problems :)
>>
>> To start with, I'm not to familiar with kerberos so go easy on me here.
>>
>> I've successfully created a machineaccount in AD (with msktutil, also
>> got it working with samba/net join)
>> and obtained a kerberos keytab. A user can obtain a ticket by running
>> 'kinit foouser', thereafter he/she
>> can run for example 'ldapsearch -b 'ou=xx,dc=xx,dc=xx,dc=xx' -Omaxssf=0
>> "(&(objectclass=user)(cn=xx))" uid'
>> successfully.
>>
>> Here's to my question, (maybe this rather should be in a kerberos
>> mailinglist, or maybe i should read a book however it's easiest to ask
>> here :))
>> Is the keytab used by sssd to authenticate to the kdc, is this even how
>> it works ? Since the sssd is runned by root and root has no ticket,
>> i figured it would work that way, but maybe I'm mistaken, maybe it's
>> suppose to work in some other way ?
>>
>>      
> SSSD does not authenticate against a KDC. We can validate the TGT with a
> host keytab, however (this proves that the response came from a real
> KDC). This would be done by setting:
> krb5_keytab = /etc/krb5.keytab
> krb5_validate = True
>
> That said, I think this is irrelevant to the issue at hand.
>
>    
>> Here's the krb5 part of the sssd.conf
>> auth_provider = krb5
>> krb5_kdcip = 123.123.123.123
>> krb5_realm = foo
>> krb5_changepw_principle = kadmin/changepw
>> krb5_ccachedir = /tmp
>> krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
>> krb5_auth_timeout = 15
>> krb5_keytab = /etc/krb5.keytab
>>
>> When i start sssd with -d10 i cant really see much messages about the
>> kerberos authentication whether it fails or not,
>>      
> Instead of starting with -d10, start with --debug-to-files and look in
> /var/log/sssd. Kerberos authentication errors will appear in
> /var/log/sssd/krb5_child.log and all other errors for this domain should
> appear in /var/log/sssd/sssd_<domain>.log
>
> however i can see
>    
>> 'Search result: Operations error(1), 00000000: LdapErr: DSID-0C090627,
>> comment: In order to perform this operation a successful bind must be
>> completed on the connection., data 0, vece'
>> which suggest that i cannot bind to ldap, right ?
>>      
> Would you mind including the LDAP portion of your sssd.conf? This issue
> seems to be with LDAP, not Kerberos.
>
>    
>> Any suggestions where to go from here, ?
>>
>> Best regards,
>> Patrik Martinsson, Sweden.
>>
>>
>>
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://fedorahosted.org/mailman/listinfo/sssd-devel
>>      
>
> - -- 
> Stephen Gallagher
> RHCE 804006346421761
>
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.14 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkxW0nUACgkQeiVVYja6o6NyhwCfdEn0TqA/UlwaaxZGH5k3E+oT
> QEYAnR87flpKlSpgrABs9w/qcwqV2NVd
> =L9GF
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
>    



More information about the sssd-devel mailing list