[SSSD] ldap shadow policy

Stephen Gallagher sgallagh at redhat.com
Sat Dec 31 13:24:17 UTC 2011



On Dec 28, 2011, at 5:06 PM, Patrick Hemmer <sssd at stormcloud9.net> wrote:

> Firstly, apologies if this isnt appropriate for this mailing list. This was the only sssd mailing list I could find.
> I'm trying to migrate a RHEL5 box from pam_ldap to sssd (version 1.5.1, official redhat package) and am having an issue getting shadow attributes working. For testing I set a shadowExpire attribute on my account in LDAP. pam_ldap obeys this correctly and will not let me log in (trying with ssh public key as the server enforces the password policy). I have added the following settings to the ldap domain to try and get this to work;
> access_provider = ldap
> ldap_access_order = expire
> ldap_account_expire_policy = shadow
> 
> But the box sill lets me log in. For testing to make sure pam was working, I set 'ldap_access_order=filter' without setting ldap_access_filter, and it properly rejected my login.
> 
> Googling the subject only turns up the man page and the patch set where these settings were added.
> Any ideas what I'm missing here?
> 
> Thanks
> 

That configuration looks correct, so we need to investigate further. Please set debug_level = 7 in the [domain/domainname] section of sssd.conf, restart sssd and retry the login with shadowExpire. Then, please open a Bugzilla ticket at bugzilla.redhat.com and attach /var/log/sssd/sssd_domainname.log (substituting domainname as appropriate). Feel free to sanitize any sensitive information.

Also, ensure that sshd_config has UsePAM=Yes and that /etc/pam.d/system-auth has pam_sss.so in the account section. Check password-auth as well.

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list