[SSSD] Configuring SSSD

Stjepan Gros sgros at zemris.fer.hr
Thu May 6 18:59:39 UTC 2010


On Thu, 2010-05-06 at 08:11 -0400, Stephen Gallagher wrote:
> On 05/06/2010 05:29 AM, Stjepan Gros wrote:
> > For the past two or so weeks I tried to configure SSSD on F-12 and RHEL6
> > beta (and also on Ubuntu 9.10) using authconfig and editing
> > configuration files without any success and it drives me crazy!
> 
> For best results on Fedora 12, you should install sssd 1.1.1-3.fc12 from 
> the updates repo, and authconfig 6.1.4-1.fc13 from here: 
> http://koji.fedoraproject.org/koji/buildinfo?buildID=165917
> 
> As Tomas mentioned, we're not bringing that version of authconfig back 
> into Fedora 12 so that we don't impose SSSD on Fedora 12 users.

I installed this version (and later I remembered that I tried F-13 also
because of the same error message). But when I try to use
authconfig-gtk, I'm constantly getting the following error message:

Traceback (most recent call last):
  File "/usr/share/authconfig/authconfig-gtk.py", line 487, in
idcombochanged
    self.currauth)
  File "/usr/share/authconfig/authconfig-gtk.py", line 450, in set_combo
    widget.append_text(textmap[entry][0])
KeyError: 'K'

And the 'Authentication Method:' list is grayed out.

> > I used tcpdump to see if anything accesses the LDAP port on IPA server
> > and there is no single try to access LDAP!
> >
> 
> The reason it's not accessing LDAP is that when using the IPA backend, 
> it's first trying to kinit as host/fedora.freeipa.local and failing 
> (because the keytab does not exist)

Well, that's very important piece of information that I was missing. :)


> Ok, we really need to document how to set up an IPA client better. The 
> IPA backend was really designed to be used when talking to FreeIPA v2. 
> It makes certain assumptions that are available but not default in 
> FreeIPA v1.
> <snip>
>

I'll try tomorrow the second version, SSSD is interesting to me because
of it's caching capabilities, and I'll give some feedback. 

> I hope this information helps you get up and running. If you have other 
> problems, don't hesitate to ask here on the list, or you can talk to us 
> directly in the #freeipa channel on irc.freenode.net
> 

Ok, and thank you for your really quick response.

Stjepan




More information about the sssd-devel mailing list