[SSSD] how does ldap_access_filter work

Stephen Gallagher sgallagh at redhat.com
Fri Aug 20 11:23:30 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/20/2010 06:24 AM, Eric Doutreleau wrote:
> hi
> 
> i m using sssd sssd-1.2.2-19 on Fedora 13 machine and i m a bit puzzled 
> by how ldap_access_filter work
...
> but when i want to log as test user with the good password i can't log
> i see in the secure log file
> 
> Aug 20 12:15:00 rst-9119 sshd[2888]: pam_sss(sshd:auth): authentication 
> success; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.159.21.234 user=test
> Aug 20 12:15:00 rst-9119 sshd[2888]: pam_sss(sshd:account): Access 
> denied for user test: 6 (Permission denied)
> 
> is it supposed to work like that?
> 
> it s a bit different from the parameter pam_filter in the ldap.conf file.


Yes, this is behaving as expected. The ldap_access_filter is an
access-control filter, not a user-id filter. There's actually no value
in filtering out normal LDAP lookups (since if it's not denied by ACIs
on the server side, it would be trivial to look up with ldapsearch,
making it useless as a security measure).

Basically, functionality works like this:
ID lookups are unaffected. If the user's account is viewable in LDAP, it
will be returned by NSS

If a user attempts to log in, PAM goes through two steps: auth and
account. The former is authentication; this step proves that you are who
you say you are. Since you entered a valid password for this user, that
part of login completes successfully. "account" is access-control, as in
"Now that we know you're you, are you supposed to have access?". This is
where the ldap filter is used. We do another lookup against the LDAP
server with that filter included. If we still get the user back, then
the user is allowed in.

There are two reasons that we do this in the account step rather than
the auth step.
1) It's less confusing. They both return the same error code, so if it
happened in auth, it would look in /var/log/secure like they were
entering the wrong password or something. The admin trying to resolve
the helpdesk call would have to eliminate more possibilities.
2) It allows the admin to set up ldap_access_filter even when not using
LDAP authentication. For example, if using LDAP for identities and
Kerberos for authentication, ldap_access_filter can still be used in the
access-control step.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkxuZbIACgkQeiVVYja6o6Nq/gCfW+Fxp323HFihrNWRYNyKrwJo
WdYAnjjSsoDlbwYy+lpcah2cBLPar8fq
=eENg
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list