[SSSD] nsswitch.conf / sssd.conf confusion

Jakub Hrozek jhrozek at redhat.com
Tue Feb 12 10:10:48 UTC 2013


On Tue, Feb 12, 2013 at 11:04:47AM +0100, Olivier wrote:
> Hello,
> 
> just to let you know that I just realized that user authentications
> on boxes where accepted based on their ldap login/passwd when
> sssd was running and sssd.conf pointing an ldap auth_provider.
> 
> You will say : and so what ?
> 
> The problem is that on that on these boxes /etc/nsswitch.conf was
> not configured to use "sss" nor "ldap".
> 
> $ cat /etc/nsswitch.conf
> ...
> passwd:     files
> shadow:     files
> group:      files
> ...
> 
> Is this the expected behaviour ?
> 
> As a result, both ldap and local password where working for users,
> both local and ldap groups considered in access.conf on that box,
> as well as access to commands that I didn't want through "sudo"
> under certain circomstances.

Are the local and ldap accounts overlapping? Was the client configured to
use sss in nsswitch.conf at some point so that there may be stalled
cache issues?

Does getent passwd -s sss ldapuser work?



More information about the sssd-devel mailing list