[SSSD] SSSD host access behavior similar to /etc/ldap.conf groupdn in pam_ldap

Stephen Gallagher sgallagh at redhat.com
Mon Jul 25 11:35:23 UTC 2011


On Sat, 2011-07-23 at 16:07 -0400, Simo Sorce wrote:
> On Mon, 2011-07-18 at 21:57 +0000, DeMarco, Dennis J (RIS-BCT) wrote:
> > I am trying to switch over from pam_ldap to use sssd authentication.
> > 
> >  
> > 
> > I have host based access based on a static ldap group and use the
> > pam_groupdn attribute in /etc/ldap.conf to restrict access to hosts. I
> > can not seem to replicate this behavior in SSSD. I have tried every
> > combination of ldap_access_filter to no great success. 
> 
> If you have the 'host' attribute set on each user what you can do is to
> set:
> access_provider = ldap
> ldap_access_filter = host=this.host.value.as.represented.in.ldap
> 
> Of course each host will have a different value.
> 
> > I do not have Memberof plugin in the old style Fedora DS 1.0.4. Is
> > there a way for SSSD to use this style of host base authentication? I
> > rather not go with a sssd/pam_ldap hybrid in system-auth.
> 
> ldap_access_filter combnined with access_provider = ldap should give you
> what you need if you have attributes on users.
> 
> If you do not then I suggest you use access_provider = simple and use
> the simple_allow_users list, although this one makes it a little harder
> because you have to change it manually on every host.
> 
> I guess we could evaluate an RFE about adding a new simple_allow_group
> option (but not a simple_deny_group one) to the simple access provider,
> if you like something like that you may want to open a feature request
> bug in our trac instance (requires fedoraprojetc.org account).
> 

SSSD has supported simple_allow_groups since SSSD 1.4.0. This is
probably the preferred solution for the moment. The catch here is that
this will only work for POSIX groups.

I have also opened https://fedorahosted.org/sssd/ticket/931 as an RFE to
support group membership for access-control directly in LDAP. This
approach will allow us to support non-POSIX groups as well.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110725/b8c59d07/attachment.sig>


More information about the sssd-devel mailing list