[SSSD-users] (no subject)

Lance Reed reed.r.lance at gmail.com
Fri Jul 18 20:25:05 UTC 2014


I am having a problem with sssd (1.9.2) and passwords expiration
against IPA v.3.0.0-37.
I have setup sssd to use IPA with LDAP not Kerberos since this is in
EC2 and I don’t want to deal with assigning tickets to each ephemeral
host.  So far things are working great, with the one exception that
due to IPA using “krbPasswordExpiration” instead of “shadowExpire”
breaks the usage of expired passwords.  I tried setting
“ldap_pwd_policy = mit_kerberos”, which does allow expired passwords
to be recognized, but then breaks the users ability to change
passwords.  I suspect it causes sssd to use al Kerberos code paths,
which won’t work in this case.  If anyone has any ideas on this I
would appreciate and feedback.  Thanks in advance.


example conf

[domain/LDAP]
enumerate = true
cache_credentials = True
debug_level = 9

id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_schema = IPA

ldap_uri = ldaps://ipa-use-1b.ec2.example.net
ldap_user_search_base = dc=example,dc=net
ldap_id_use_start_tls = true
tls_reqcert = demand
ldap_tls_cacert = /etc/ipa/ca.crt


ldap_user_ssh_public_key = ipaSshPubKey
#ldap_pwd_policy =  shadow
#ldap_user_shadow_expire = krbPasswordExpiration
#ldap_pwd_policy = mit_kerberos


[sssd]
services = nss, pam, ssh
config_file_version = 2

domains = LDAP
[nss]

[pam]

[sudo]

[autofs]

[ssh]

[pac]


More information about the sssd-users mailing list