[SSSD] Access denied by pam_sss(sshd:account)

Mathieu Bouillaguet mathieu.bouillaguet at gmail.com
Thu Jun 27 23:12:37 UTC 2013


I have two more questions for my own knowledge and maybe those of others :

* 1st question :
If 2 users, a local user called "aminata" and a domain user
"aminata at domain" exist, how does sssd choose who we are when we ssh in
the system with a username of "aminata" and the re_expressions is set to:

"(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))"

which allows three different styles for user names:

    • username 
    • username at domain.name <mailto:username at domain.name> 
    • domain\username 

?

* 2nd question :
If we have two AD domains A and B. A linux machine is in the domain B,
and we want the users from domain A to be able to authenticate in the
linux machine. Our sssd configuration is id_provider=ldap
(ldaps://auth.domainA.com), auth_provider=krb5 (auth.domainA.com). A
keytab was generated for the linux machine on domain B AD and installed
on the machine. Is this architecture possible without using a trust
relationship from domain A to domain B ? My first thought is that it's
not possible since the linux system belonging to domain B needs to be
able to browse the directory of domain A.

Thanks in advance for your replies.

Mathieu

Le 26/06/2013 23:10, Jakub Hrozek a écrit :
> On Wed, Jun 26, 2013 at 08:23:40PM +0200, Mathieu Bouillaguet wrote:
>> I solved my problem thanks to your reply :-)
>>
>> For the others, my access provider is ldap and I didn't configured the
>> ldap_access_filter. If ldap_access_filter isn't configured and filter is in
>> the ldap_access_order (which is the default when it's not specified) all
>> users are denied access.
>>
>> After having configured ldap_access_filter with a valid
>> memberOf=cn=authorizedUsersGroup, ou=... and added my users to this group
>> on the DC everything work as expected.
>>
> Hi Mathieu,
>
> you're not the first to run into this issue, so the latest SSSD versions
> clarify the access order better in the man pages.
>
> I'm glad it's working for you now!
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130628/59b13a35/attachment.html>


More information about the sssd-devel mailing list