[SSSD] SSSD host access behavior similar to /etc/ldap.conf groupdn in pam_ldap

Simo Sorce simo at redhat.com
Mon Jul 25 12:06:06 UTC 2011


On Mon, 2011-07-25 at 07:35 -0400, Stephen Gallagher wrote:
> On Sat, 2011-07-23 at 16:07 -0400, Simo Sorce wrote:
> > On Mon, 2011-07-18 at 21:57 +0000, DeMarco, Dennis J (RIS-BCT) wrote:
> > > I am trying to switch over from pam_ldap to use sssd authentication.
> > > 
> > >  
> > > 
> > > I have host based access based on a static ldap group and use the
> > > pam_groupdn attribute in /etc/ldap.conf to restrict access to hosts. I
> > > can not seem to replicate this behavior in SSSD. I have tried every
> > > combination of ldap_access_filter to no great success. 
> > 
> > If you have the 'host' attribute set on each user what you can do is to
> > set:
> > access_provider = ldap
> > ldap_access_filter = host=this.host.value.as.represented.in.ldap
> > 
> > Of course each host will have a different value.
> > 
> > > I do not have Memberof plugin in the old style Fedora DS 1.0.4. Is
> > > there a way for SSSD to use this style of host base authentication? I
> > > rather not go with a sssd/pam_ldap hybrid in system-auth.
> > 
> > ldap_access_filter combnined with access_provider = ldap should give you
> > what you need if you have attributes on users.
> > 
> > If you do not then I suggest you use access_provider = simple and use
> > the simple_allow_users list, although this one makes it a little harder
> > because you have to change it manually on every host.
> > 
> > I guess we could evaluate an RFE about adding a new simple_allow_group
> > option (but not a simple_deny_group one) to the simple access provider,
> > if you like something like that you may want to open a feature request
> > bug in our trac instance (requires fedoraprojetc.org account).
> > 
> 
> SSSD has supported simple_allow_groups since SSSD 1.4.0. This is
> probably the preferred solution for the moment. The catch here is that
> this will only work for POSIX groups.
> 
> I have also opened https://fedorahosted.org/sssd/ticket/931 as an RFE to
> support group membership for access-control directly in LDAP. This
> approach will allow us to support non-POSIX groups as well.

Ah I guess I was looking at an outdated manpage :-/

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list