[SSSD] Authentication against AD

Stephen Gallagher sgallagh at redhat.com
Tue Nov 1 12:33:22 UTC 2011


On Tue, 2011-11-01 at 08:42 +0100, Thomas Jagt wrote:
> Hi Stephen,
> 
> We are using sssd to authenticate against AD with using Kerberos and
> LDAP.
> The idea is to filter users who are allowed to login based on a LDAP
> filter.
> In the AD there are computer objects created with the same name as the
> hostname of the Linux client.
> 
> The filter must be something like is;
> If the computer object is a member of the group where the user is
> memberOf then allow the user to login.
> 
> So what we want is to authenticate linux clients based on computer
> objects in the AD. (We are not using winbind)
> 
> When using the ldap_access_filter it's not possible to create a LDAP
> query neither with the ldap_group_search_filter.
> 
> Is it possible with sssd to meet our requirements?
> 
> The following ldapsearch gives the right output;
>  ldapsearch -h test.local -s sub -x -b ",ou=Groups,dc=test,dc=local"
> "(&(member=cn=`hostname`,cn=Computers,dc=test,dc=local))"
> 


The way the ldap_access_filter works is that it always adds whatever the
provided filter is to (&(uid=login_user,USER_SEARCH_BASE)(...)) so that
it's always testing the user entry.

So if you create a filter 
(member=cn=`hostname`,cn=Computers,dc=test,dc=local)

it becomes internally:

(&(uid=login_user,USER_SEARCH_BASE)((member=cn=`hostname`,cn=Computers,dc=test,dc=local))

I'm not sure there's any way to accomplish what you're trying to do,
which is get a list of the user's groups and then check whether any of
them contains the member=hostname entry. We could possibly change the
ldap_access_filter command to be a completely generic search, but the
problem with that approach is figuring out how to specify the username
or the user's groups during the search. Username would be easy, we could
make it a template, but telling it to search the user's groups would be
very complicated, since we can't know at the time of filter creation how
many there would be.


I'm willing to entertain suggestions on how to enable this in such a way
that a human being would be able to create the filter.

The other option is that I could help walk you through creating your own
access_provider plugin for SSSD. (It's not a documented process because
it has to be done in-tree at the moment). But this way, you could craft
one to your specific needs.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111101/649d78ef/attachment.sig>


More information about the sssd-devel mailing list