[SSSD-users] LDAP access provider - list of groups in directory?
Jakub Hrozek
jhrozek at redhat.com
Wed Jul 9 21:28:29 UTC 2014
On 07 Jul 2014, at 11:00, John Snowdon <John.Snowdon at newcastle.ac.uk> wrote:
> Hi,
>
> I'm currently working on an sssd configuration to replace a set of legacy authentication and authorization mechanisms on several hundred Linux systems in our department - they're currently supported via shared /etc/passwd and /etc/group files.
>
> I've got access, user and group information all working well via pam and sssd and am now trying to find a solution to the authorisation requirements. Previously this was managed via puppet-distributed changes to /etc/pam.d with a list of users/groups per machine stored in the puppet nodes files.
> I'd like to move to a setup where each machine (or class of machine) just pulls the list of allowed unix groups from it's own node in OpenLDAP.
>
> Is there anything available in sssd.conf that would allow the ldap access provider to pull back a list of allowed groups from ldap, rather than listing them explicitly? Sort of a hybrid between the simple_allow_groups and ldap_access_filter?
>
> e.g. What I would love to do
>
> access_provider = ldap
> ldap_allow_groups_dn = cn=MachineA,ou=machines,dc=network,dc=com
>
> Where the cn=MachineA object is a groupOfNames that would look something like:
>
> objectClass: groupOfNames
> objectClass: top
> cn: MachineA
> description: Posix groups whose users are allowed to access MachineA
> member: root
> member: localusers
> member: adminusers
> member: webusers
>
> I'd much rather have the lists of groups allowed to access a machine managed from LDAP, rather than directly coded into sssd.conf, or alternatively, via pam_listfile. Is there any way of enabling this in the current version of sssd, or emulating it somehow via ldap_access_filter?
>
> Cheers,
> John
Hi John,
The one-sentence answer is not easily, sorry.
The thing about ldap_access_filter to keep in mind is that the filter is applied on the /user entry/ when the user logs in. Basically, the ldap_access_filter is AND-ed with a filter that involves the user entry, if there is a match, the access is allowed, otherwise the access is denied.
One solution I can think about is to use the memberof overlay with OpenLDAP and then employ a filter on the client side that would include memberof=allowed_group_dn. But to be honest, I don’t have too much experience with the memberof overlay, so I’m not sure if this suggestion would work for nested groups for example.
I hope the explanation on how the ldap_access_filter works is still useful. Please let us know if you have any more questions!
More information about the sssd-users
mailing list