[SSSD-users] SSH - sssd: PAM: do_pam_account pam_acct_mgmt = 6 (Permission denied)
Sterling Sahaydak
sterling.sahaydak at pi-coral.com
Wed Apr 29 16:35:29 UTC 2015
Thanks Jakub.
Hmmm, not sure I understand, can you elaborate with an example using
dc=ad,dc=example,dc=com?
Thanks,
Sterling
------ Original Message ------
From: "Jakub Hrozek" <jhrozek at redhat.com>
To: "Sterling Sahaydak" <sterling.sahaydak at pi-coral.com>
Cc: "Sumit Bose" <sbose at redhat.com>; "End-user discussions about the
System Security Services Daemon" <sssd-users at lists.fedorahosted.org>
Sent: 4/29/2015 12:29:11 PM
Subject: Re: [SSSD-users] SSH - sssd: PAM: do_pam_account pam_acct_mgmt
= 6 (Permission denied)
>On Wed, Apr 29, 2015 at 04:23:01PM +0000, Sterling Sahaydak wrote:
>> Solved my issue!
>>
>> The key wasn't from the messages running sssd using: /usr/sbin/sssd
>>-D
>> -ddd and reading what was sent to screen.
>>
>> Instead it was looking within the sssd_LDAP.log file itself:
>>
>> (Wed Apr 29 11:42:58 2015) [sssd[be[LDAP]]] [sdap_access_filter_send]
>> (0x0400): No filter set.
>> (Wed Apr 29 11:42:58 2015) [sssd[be[LDAP]]] [sdap_access_done]
>>(0x0400):
>> Access was denied.
>>
>> The ldap_access_filter set to:
>>
>> ldap_access_filter = ou=example,dc=ad,dc=example,dc=com
>>
>> Appears this is not a filter.
>>
>> To resolve, changed it to use:
>>
>> ldap_access_filter =
>>memberof=cn=groupname,ou=groups,dc=ad,dc=example,dc=com
>>
>> The documentation is a little vague for ldap_access_filter as to what
>> qualifies clearly as a filter.
>>
>>
>> malformed filter in the code didn't appear to get triggered?
>>
>>
>> Thanks again to Jakub and Sumit for taking the time to help!!!
>
>I'm glad it works fine for you now, but please note the simple access
>provider is a much better choice for restricting access by groups
>because the memberof attribute in AD only points to direct parents, not
>all parents.
More information about the sssd-users
mailing list