[SSSD-users] sssd basic questions - solved

Robert Zmijan robert.zmijan at softel.pl
Mon Jun 9 23:06:25 UTC 2014


> Dmitri Pal wrote:
>> On 06/09/2014 01:56 PM, Robert Zmijan wrote:
>>> OK, I understand why it should not be able to read passwords. However,
>>> under 'access to attrs=userPassword' in my slapd.conf if I comment out
>>> the line 'by dn="userid=sssd,ou=People,dc=myhost,dc=net" read' the sssd
>>> cannot establish a successful bind. In consequence I cannot login any
>>> user in. What is the best way to allow sssd to read its own password but
>>> not allow to access to others' passwords?
>>>
>>> Below my slapd.conf
>>>
>>> ---------------
>>> access to dn="cn=subschema"
>>>          by * read
>>>
>>> access to attrs=userPassword
>>>          by dn="uid=root,ou=People,dc=myhost,dc=net" write
>>>          by dn="userid=sssd,ou=People,dc=myhost,dc=net" read
>>>          by self write
>>>          by anonymous auth
>>>          by * auth
>>>
>>> access to attrs=sshPublicKey
>>>          by dn="uid=root,ou=People,dc=myhost,dc=net" write
>>>          by self write
>>>          by * read
>>>
>>> access to *
>>>          by dn="cn=user1,ou=People,dc=myhost,dc=net" read
>>>          by dn="uid=user3,ou=People,dc=myhost,dc=net" write
>>>          by dn="uid=user2,ou=People,dc=myhost,dc=net" write
>>>          by dn="uid=root,ou=People,dc=myhost,dc=net" write
>>>          by dn="userid=sssd,ou=People,dc=myhost,dc=net" read
>>>          by * search
>>
>> Can you bind with sssd user and its password via an LDAP search command with
>> or without this setting?
>> You should be able to because when you remove the line sssd would authenticate
>> as itself and thus self rules would apply.
>> If this is possible that means that your password is OK and the problem is in
>> SSSD. If it failes this means that your password for SSSD user is not correct
>> (may be it requires change).
> 
> Dealing with OpenLDAP ACLs is rather off-topic here.
> But I feel it's appropriate to point to this FAQ entry:
> 
> http://www.openldap.org/faq/data/cache/320.html
> 
> Hint: Even sssd does not have to read its own password hash.
> 
> You can safely omit this line
> 
> by anonymous auth
> 
> because there's already this last line
> 
> by * auth
> 
> More details in the OpenLDAP Faq-O-Matic and slapd.access(5). Feel free to ask
> OpenLDAP ACL questions on the openldap-technical mailing list.
> 
> And yes, try to test by simulating with ldapsearch like Dmitri suggested.
> 
> Ciao, Michael.

Thanks Michael and Dmitri
I tested two cases:

1) I commented out under 'access to attrs=userPassword'
the entry 'by dn="userid=sssd,ou=People,dc=myhost,dc=net" read'

and did

ldapsearch -LLL -ZZ -h 127.0.0.1 -D
userid=sssd,ou=People,dc=myhost,dc=net -w mysssdpasswd -b
userid=sssd,ou=people,dc=myhost,dc=net

result: ldap_bind: Invalid credentials (49)

when the same line is not commented the search is a success.

It is most likely that i missed something in ldap configuration. SSSD
has clearly nothing to do here.

I'll search for solutions on the ldap faq/groups

Cheers
Robert





More information about the sssd-users mailing list