[SSSD-users] sssd basic questions - solved

Robert Zmijan robert.zmijan at softel.pl
Mon Jun 9 17:56:18 UTC 2014


>>
>> Now I have my obfuscated passwd in sssd.config file.
>> Can you tell me what is now best to do on the ldap side to make SSSD
>> authenticate itself with that password?
> 
> You have to create the cn=sssd,ou=services,dc=myhost,dc=net user object
> and set the password. Additionally I would recommend to assign an
> appropriate access control for this user. E.g. it should not be allowed
> to read passwords.
> 
> HTH
> 
> bye,
> Sumit
OK, I understand why it should not be able to read passwords. However,
under 'access to attrs=userPassword' in my slapd.conf if I comment out
the line 'by dn="userid=sssd,ou=People,dc=myhost,dc=net" read' the sssd
cannot establish a successful bind. In consequence I cannot login any
user in. What is the best way to allow sssd to read its own password but
not allow to access to others' passwords?

Below my slapd.conf

---------------
access to dn="cn=subschema"
        by * read

access to attrs=userPassword
        by dn="uid=root,ou=People,dc=myhost,dc=net" write
        by dn="userid=sssd,ou=People,dc=myhost,dc=net" read
        by self write
        by anonymous auth
        by * auth

access to attrs=sshPublicKey
        by dn="uid=root,ou=People,dc=myhost,dc=net" write
        by self write
        by * read

access to *
        by dn="cn=user1,ou=People,dc=myhost,dc=net" read
        by dn="uid=user3,ou=People,dc=myhost,dc=net" write
        by dn="uid=user2,ou=People,dc=myhost,dc=net" write
        by dn="uid=root,ou=People,dc=myhost,dc=net" write
        by dn="userid=sssd,ou=People,dc=myhost,dc=net" read
        by * search


More information about the sssd-users mailing list