[SSSD] sssd and kerberos.

Stephen Gallagher sgallagh at redhat.com
Mon Aug 2 14:44:08 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/02/2010 10:38 AM, Patrik Martinsson wrote:
> If i change, auth_provider to ldap instead of krb5 and add,
> ldap_default_bind_dn = cn=xx,ou=People,dc=xx,dc=xx,dc=xx
> ldap_default_authtok_type = password
> ldap_default_authtok = xx
> 
> Then i got the expected result.
> It's only when i change sssd to use krb authentication it fails.
> 

Try leaving the ldap_default_* options alone and just changing
auth_provider = krb5
krb5_kdcip = <IP or FQDN>


The options you have set above have nothing to do with authentication.
They're used to set the bind type that SSSD itself users to query the
LDAP server for the list of acceptable usernames. It's not used for
authenticating the users themselves.

So when you removed those lines to set up Kerberos, you made it so that
the SSSD cannot look up usernames, and thus would not be able to perform
an authentication against Kerberos.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkxW2bgACgkQeiVVYja6o6OQiQCfWbr2HRfpYMCOY/NKt6/nlcTI
l8sAoKCUKQfC69JAMkRBUX8nT8xVE2ss
=ryB5
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list