[SSSD] chpass_provider

Frank Dornheim conloos at googlemail.com
Thu Jun 9 07:20:24 UTC 2011


Hi list,

i have a running sssd, ldap, krb5 system.

client [sssd] --> [openLdap] --> KRB5

So everything work expected. My LDAP user use LDAP/ KRB5 if there is a
connect and sssd is offline.

But i dont understand the chpass_provider. For a basic orientation are
example config at the end.
If i try to change my password and the LDAP/ Kerberos- server is
stopped i get an: "System is offline, password change not possible".
But if the LDAP/Kerberos- server is online i use PAM to change the kerberos PW.

So why i should configure the chpass_provider and in which
circumstances sssd the chpass_provider.


Thanks Con

__my sssd.conf conf__

[domain/EXAMPLE.ORG]
auth_provider = ldap
id_provider = ldap
ldap_schema = rfc2307
ldap_uri = ldaps://ldap.example.org
ldap_search_base = dc=example,dc=org
ldap_user_search_base =  ou=users,dc=example,dc=org
ldap_group_search_base = ou=groups,dc=example,dc=org
ldap_default_bind_dn = cn=unpriv-ldap-nss-srv,ou=services,dc=example,dc=org
ldap_default_authtok_type = password
ldap_default_authtok = securepass
krb5_server = kerberos.example.org
krb5_kpasswd = kerberos.example.org
krb5_changepw_principal = kadmin/changepw
krb5_realm = EXAMPLE.ORG
ldap_pwd_policy = mit_kerberos
chpass_provider=krb5
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/cacert.pem
cache_credentials = true
enumerate = False
min_id = 10000
max_id = 29999

__my auth-client-config__
[sssd.krb5]
nss_passwd=     passwd:         compat sss
nss_group=      group:          compat sss
nss_shadow=     shadow:         compat
nss_netgroup=   netgroup:       nis

pam_auth=       auth    required                        pam_env.so
                auth    [success=4 default=ignore]      pam_krb5.so
try_first_pass
                auth    [success=3 default=ignore]      pam_unix.so
debug nullok_secure try_first_pass
                auth    requisite
pam_succeed_if.so uid >= 10000 quiet
                auth    [success=1 default=ignore]      pam_sss.so
use_first_pass
                auth    requisite                       pam_deny.so
                auth    required                        pam_permit.so

pam_account=    account required
 pam_krb5.so
                account required
 pam_unix.so
                account sufficient
 pam_localuser.so
                account sufficient
 pam_succeed_if.so uid < 10000 quiet
                account [default=bad success=ok user_unknown=ignore]
 pam_sss.so
                account required
 pam_permit.so

pam_password=   password        requisite       pam_cracklib.so
try_first_pass difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
                password        sufficient      pam_krb5.so
try_first_pass use_authtok
                password        sufficient      pam_unix.so
try_first_pass use_authtok sha512
                password        sufficient      pam_sss.so use_authtok
                password        required        pam_deny.so

pam_session=    session required
pam_mkhomedir.so skel=/etc/skel/ umask=0077
                session optional                        pam_keyinit.so revoke
                session optional                        pam_krb5.so
                session required                        pam_limits.so
                session [success=1 default=ignore]      pam_sss.so
                session required                        pam_unix.so



More information about the sssd-devel mailing list