[SSSD] chpass_provider

Sumit Bose sbose at redhat.com
Thu Jun 9 08:03:41 UTC 2011


On Thu, Jun 09, 2011 at 09:20:24AM +0200, Frank Dornheim wrote:
> Hi list,
> 
> i have a running sssd, ldap, krb5 system.
> 
> client [sssd] --> [openLdap] --> KRB5
> 
> So everything work expected. My LDAP user use LDAP/ KRB5 if there is a
> connect and sssd is offline.
> 
> But i dont understand the chpass_provider. For a basic orientation are
> example config at the end.
> If i try to change my password and the LDAP/ Kerberos- server is
> stopped i get an: "System is offline, password change not possible".
> But if the LDAP/Kerberos- server is online i use PAM to change the kerberos PW.
> 
> So why i should configure the chpass_provider and in which
> circumstances sssd the chpass_provider.

You still have pam_krb5 in your pam configuration and authentication and
password changes and handled by pam_krb. If you use sssd you can remove
pam_krb5 from your pam configuration and set 'auth_provider = krb5' to
let sssd handle kerberos authentication. Also password changes will be
handled by sssd if you remove pam_krb5 and set 'chpass_provider = krb5'.

HTH

bye,
Sumit

> 
> 
> Thanks Con
> 
> __my sssd.conf conf__
> 
> [domain/EXAMPLE.ORG]
> auth_provider = ldap
> id_provider = ldap
> ldap_schema = rfc2307
> ldap_uri = ldaps://ldap.example.org
> ldap_search_base = dc=example,dc=org
> ldap_user_search_base =  ou=users,dc=example,dc=org
> ldap_group_search_base = ou=groups,dc=example,dc=org
> ldap_default_bind_dn = cn=unpriv-ldap-nss-srv,ou=services,dc=example,dc=org
> ldap_default_authtok_type = password
> ldap_default_authtok = securepass
> krb5_server = kerberos.example.org
> krb5_kpasswd = kerberos.example.org
> krb5_changepw_principal = kadmin/changepw
> krb5_realm = EXAMPLE.ORG
> ldap_pwd_policy = mit_kerberos
> chpass_provider=krb5
> ldap_tls_reqcert = demand
> ldap_tls_cacert = /etc/ssl/certs/cacert.pem
> cache_credentials = true
> enumerate = False
> min_id = 10000
> max_id = 29999
> 
> __my auth-client-config__
> [sssd.krb5]
> nss_passwd=     passwd:         compat sss
> nss_group=      group:          compat sss
> nss_shadow=     shadow:         compat
> nss_netgroup=   netgroup:       nis
> 
> pam_auth=       auth    required                        pam_env.so
>                 auth    [success=4 default=ignore]      pam_krb5.so
> try_first_pass
>                 auth    [success=3 default=ignore]      pam_unix.so
> debug nullok_secure try_first_pass
>                 auth    requisite
> pam_succeed_if.so uid >= 10000 quiet
>                 auth    [success=1 default=ignore]      pam_sss.so
> use_first_pass
>                 auth    requisite                       pam_deny.so
>                 auth    required                        pam_permit.so
> 
> pam_account=    account required
>  pam_krb5.so
>                 account required
>  pam_unix.so
>                 account sufficient
>  pam_localuser.so
>                 account sufficient
>  pam_succeed_if.so uid < 10000 quiet
>                 account [default=bad success=ok user_unknown=ignore]
>  pam_sss.so
>                 account required
>  pam_permit.so
> 
> pam_password=   password        requisite       pam_cracklib.so
> try_first_pass difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
>                 password        sufficient      pam_krb5.so
> try_first_pass use_authtok
>                 password        sufficient      pam_unix.so
> try_first_pass use_authtok sha512
>                 password        sufficient      pam_sss.so use_authtok
>                 password        required        pam_deny.so
> 
> pam_session=    session required
> pam_mkhomedir.so skel=/etc/skel/ umask=0077
>                 session optional                        pam_keyinit.so revoke
>                 session optional                        pam_krb5.so
>                 session required                        pam_limits.so
>                 session [success=1 default=ignore]      pam_sss.so
>                 session required                        pam_unix.so
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list