[SSSD] Trying to get id proxy to work

Joshua C. Endries jce54 at cornell.edu
Wed Oct 17 19:41:45 UTC 2012


Hello,

I'm trying to set sssd up so that I use a local passwd file for accounts and Kerberos for authentication, until AD is set up with the correct attributes (which will be a while). I have Kerberos working via krb5.conf, and LDAP sort of works via ldap.conf (except the important parts) but I will need to switch to SSSD eventually. I was hoping to get this going now with local accounts to make things easier down the road. This is on RHEL 5 right now. I'm hoping 6 isn't much different.

I'm having some trouble (shocker!) so my first question is: is this configuration possible?

My sssd.conf is pretty basic so far:

[sssd]
config_file_version = 2
domains = DEFAULT
services = nss, pam

[nss]

[pam]

[domain/DEFAULT]
auth_provider = krb5
id_provider = proxy
proxy_lib_name = files
krb5_server = kerberos.foo.com
krb5_realm = IT.FOO.COM

These are some of the errors I'm seeing:

[sssd[pam]] [sss_dp_get_reply] (4): Got reply (3, 19, Initgroups call not supported) from Data Provider
[sssd[pam]] [pam_check_user_dp_callback] (2): Unable to get information from Data Provider
[sssd[pam]] [pam_check_user_search] (4): Requesting info for [jce54 at DEFAULT]
[pam_check_user_search] (2): No matching domain found for [jce54], fail!
sshd[6592]: pam_sss(sshd:auth): received for user jce54: 10 (User not known to the underlying authentication module)

This suggests to me that it's not talking with NSS somehow...

/etc/pam.d/system-auth:

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
#auth        sufficient    pam_krb5.so use_first_pass
auth        required      pam_deny.so

#account     sufficient    pam_ldap.so
account     required      pam_unix.so broken_shadow
account     sufficient    pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
#account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
#password    sufficient    pam_krb5.so use_authtok minimum_uid=1000
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session sufficient pam_sss.so
session     required      pam_unix.so

I read in one of the man pages I think that sssd will append the krb5_realm to the username if there isn't a domain there, and I'm logging in with jce54, so it *should* I think use jce54 at IT.FOO.COM, but doesn't appear to do anything Kerberos-wise so maybe that's not an issue (yet).

Thanks,
Josh


More information about the sssd-devel mailing list