[SSSD] SSSD host access behavior similar to /etc/ldap.conf groupdn in pam_ldap

Simo Sorce simo at redhat.com
Sat Jul 23 20:07:17 UTC 2011


On Mon, 2011-07-18 at 21:57 +0000, DeMarco, Dennis J (RIS-BCT) wrote:
> I am trying to switch over from pam_ldap to use sssd authentication.
> 
>  
> 
> I have host based access based on a static ldap group and use the
> pam_groupdn attribute in /etc/ldap.conf to restrict access to hosts. I
> can not seem to replicate this behavior in SSSD. I have tried every
> combination of ldap_access_filter to no great success. 

If you have the 'host' attribute set on each user what you can do is to
set:
access_provider = ldap
ldap_access_filter = host=this.host.value.as.represented.in.ldap

Of course each host will have a different value.

> I do not have Memberof plugin in the old style Fedora DS 1.0.4. Is
> there a way for SSSD to use this style of host base authentication? I
> rather not go with a sssd/pam_ldap hybrid in system-auth.

ldap_access_filter combnined with access_provider = ldap should give you
what you need if you have attributes on users.

If you do not then I suggest you use access_provider = simple and use
the simple_allow_users list, although this one makes it a little harder
because you have to change it manually on every host.

I guess we could evaluate an RFE about adding a new simple_allow_group
option (but not a simple_deny_group one) to the simple access provider,
if you like something like that you may want to open a feature request
bug in our trac instance (requires fedoraprojetc.org account).

Another option if you use posix groups in ldap (ie groups you can list
with getent group name) is to use pam_access with access.conf

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list