[SSSD] sssd on RHEL5 w/ OpenLDAP backend issues

Stephen Gallagher sgallagh at redhat.com
Thu Jan 26 23:19:33 UTC 2012


On Thu, 2012-01-26 at 14:41 -0800, Eric wrote:
> Hello,
> 
> I have searched for an appropriate list to post this question and
> figured this was the best I could find and apologize in advance for the
> wasted bandwidth and chatter. Just point me to the right direction.
> 

Nope, you've come to the right place. We don't have a separate users
list.

> 
> I am trying to implement a password policy (i.e. password expiration
> (max age), password history, etc) on RHEL 5. I am kind of at a loss. Is
> there any plans to add functionality into sssd for RHEL5 that will give
> this type of functionality? See below for details on what I have tried.
> 

SSSD should already support this (to a certain extent).

> 
> I was hoping to use sssd with the backend of OpenLDAP 2.4.26 since this
> is used extensively at my organization already.
> 
> I tried using the ppolicy overlay from OpenLDAP, but that does not
> provide any feedback to the user about pending password expiration via
> sssd.
> 

Yes it does, though by default we don't report it unless the expiration
is fewer than seven days away. This is configurable with
pam_pwd_expiration_warning = N
Where N is the number of days in advance to warn.

> So at the time and date of expiration, the user is unable to login
> without any prior warning and is unable to login.
> 
> Instead I see the following in /var/log/sssd/sssd_LDAP.log 
> 
>      [sssd[be[LDAP]]] [sdap_control_create] (3): Server does not
> support the requested control [1.3.6.1.4.1.42.2.27.8.5.1].   The above
> apparently is the ldap contral which gives the warning about password
> expiration which sssd does not see.
> 

You're hitting https://bugzilla.redhat.com/show_bug.cgi?id=748856 which
is fixed in RHEL 5.8 (and is available in the RHEL 5.8 beta right now).

We already support this control fully, but we had a bug where we weren't
properly detecting that the server supported it.


> Any plans to update sssd for RHEL5 to support "Controls used for Password Policy" found in
> http://tools.ietf.org/html/draft-behera-ldap-password-policy-07. 
> 
> I can provide more information upon request.
> 
> 
> Any help with this would be greatly appreciated.



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120126/d88b3d74/attachment.sig>


More information about the sssd-devel mailing list