[SSSD] Access denied by pam_sss(sshd:account)

Dmitri Pal dpal at redhat.com
Fri Jun 28 13:49:12 UTC 2013


On 06/28/2013 03:53 AM, Jakub Hrozek wrote:
> On Fri, Jun 28, 2013 at 01:12:37AM +0200, Mathieu Bouillaguet wrote:
>> I have two more questions for my own knowledge and maybe those of others :
>>
>> * 1st question :
>> If 2 users, a local user called "aminata" and a domain user
>> "aminata at domain" exist, how does sssd choose who we are when we ssh in
>> the system with a username of "aminata" and the re_expressions is set to:
>>
> First, what is a "local domain" ? Does that mean that the user resides
> in /etc/passwd ?
>
> If so, then the order of databases that is queried depends on the
> configuration in /etc/nsswitch.conf, in particular the lines starting
> with "passwd" for users and "groups" for groups. You should use "files
> sss" because you still want root and users that represent various system
> services to be queried locally first.
>
>> "(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))"
>>
>> which allows three different styles for user names:
>>
>>     • username 
>>username at domain.name <mailto:username at domain.name> 
>>     • domain\username 
>>
> You can ssh in as:
>
> ssh system.example.com -l username at domain.name
>
> for instance
>
>> ?
>>
>> * 2nd question :
>> If we have two AD domains A and B. A linux machine is in the domain B,
>> and we want the users from domain A to be able to authenticate in the
>> linux machine. Our sssd configuration is id_provider=ldap
>> (ldaps://auth.domainA.com), auth_provider=krb5 (auth.domainA.com). A
>> keytab was generated for the linux machine on domain B AD and installed
>> on the machine. Is this architecture possible without using a trust
>> relationship from domain A to domain B ? My first thought is that it's
>> not possible since the linux system belonging to domain B needs to be
>> able to browse the directory of domain A.
>>
> No, I don't think this is possible, you should kinit against the KDC
> that generated the keytab.
>
>> Thanks in advance for your replies.
>>
>> Mathieu
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Jakub,

If you define two domains can you have two different keytabs in SSSD?
I do not think so. Do we have an RFE to support that?
Also may be it can be hacked so that connection to one domain is armored
with keytab and to another is armored by certs?
Can we use just LDAP for the second domain instead of kerberos auth?

Also in 1.10 SSSD should support transitive trusts so if there is a
trust between the domains SSSD 1.10 should be able to authenticate users
from both domains.

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list