[SSSD-users] sssd basic questions - solved
Robert Zmijan
robert.zmijan at softel.pl
Mon Jun 9 17:56:18 UTC 2014
>>
>> Now I have my obfuscated passwd in sssd.config file.
>> Can you tell me what is now best to do on the ldap side to make SSSD
>> authenticate itself with that password?
>
> You have to create the cn=sssd,ou=services,dc=myhost,dc=net user object
> and set the password. Additionally I would recommend to assign an
> appropriate access control for this user. E.g. it should not be allowed
> to read passwords.
>
> HTH
>
> bye,
> Sumit
OK, I understand why it should not be able to read passwords. However,
under 'access to attrs=userPassword' in my slapd.conf if I comment out
the line 'by dn="userid=sssd,ou=People,dc=myhost,dc=net" read' the sssd
cannot establish a successful bind. In consequence I cannot login any
user in. What is the best way to allow sssd to read its own password but
not allow to access to others' passwords?
Below my slapd.conf
---------------
access to dn="cn=subschema"
by * read
access to attrs=userPassword
by dn="uid=root,ou=People,dc=myhost,dc=net" write
by dn="userid=sssd,ou=People,dc=myhost,dc=net" read
by self write
by anonymous auth
by * auth
access to attrs=sshPublicKey
by dn="uid=root,ou=People,dc=myhost,dc=net" write
by self write
by * read
access to *
by dn="cn=user1,ou=People,dc=myhost,dc=net" read
by dn="uid=user3,ou=People,dc=myhost,dc=net" write
by dn="uid=user2,ou=People,dc=myhost,dc=net" write
by dn="uid=root,ou=People,dc=myhost,dc=net" write
by dn="userid=sssd,ou=People,dc=myhost,dc=net" read
by * search
More information about the sssd-users
mailing list