[SSSD-users] rfc2307bis
Brendan Kearney
bpk678 at gmail.com
Fri Jan 9 02:42:58 UTC 2015
On Thu, 2015-01-08 at 21:19 -0500, Dmitri Pal wrote:
> On 01/08/2015 08:33 PM, Brendan Kearney wrote:
> > i am so close yet so far...
> >
> > i have an older env with ldap, kerberos, sasl and sssd using rfc2307.
>
> Are you talking about server or client?
> Is your server IPA or something else?
>
> If your server is IPA then if you want to use 2307bis you point clients
> to the main user tree.
> If you want clients that do not understand 2307bis (for example solaris)
> you need to enable compat plugin and point clients to cn=compat.
>
> If SSSD is configured to use 2307bis but server is 2307 or vice verse
> SSSD will have problems fetching groups.
> > i built a new env with ldap, kerberos, sasl and sssd using rfc2307bis.
> > i am finding that when i ssh into one of the new boxes and run "id", i
> > am only getting back:
> >
> > uid=1000(brendan) gid=1000(brendan) groups=1000(brendan)
> >
> > the info is all the rfc2307/posix info, and not any of the rfc2307bis
> > info. i am a member of several other groups that are groupOfNames
> > objects, but the "id" command is not returning them.
> >
> > is there a client side config that i am missing, in order to get the
> > group memberships of groupOfNames groups? i imagine i could add the
> > posixAccount object class to those groupOfNames groups, but wanted to
> > make sure that was the only/right way to do things before i did it.
>
> man sssd-ldap
>
> >
> > i am not clueless, just have one clue less...
> >
> > brendan
> >
> > _______________________________________________
> > sssd-users mailing list
> > sssd-users at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>
>
my new environment is 2 servers and a client. the servers are fedora
20, with ldap, kerberos, sasl and sssd, but not IPA. the client is
fedora 20 with sssd. in both/all cases, they are rfc2307bis.
i have read the sssd man pages, but i am not sure what i am missing.
the client sssd.conf:
[sssd]
domains = bpk2.com
services = nss, pam, sudo
config_file_version = 2
#debug_level = 4
[nss]
filter_groups = root
filter_users = root
[pam]
[sudo]
[domain/bpk2.com]
#debug_level = 4
id_provider = ldap
ldap_schema = rfc2307bis
ldap_uri = _srv_,ldap://ldap1.bpk2.com,ldap://ldap2.bpk2.com
ldap_search_base = dc=bpk2,dc=com
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = host/nas.bpk2.com
ldap_sasl_realm = BPK2.COM
auth_provider = krb5
krb5_server = _srv_,kerberos.bpk2.com
krb5_realm = BPK2.COM
krb5_renewable_lifetime = 7d
krb5_lifetime = 24h
krb5_renew_interval = 1h
krb5_store_password_if_offline = true
cache_credentials = true
sudo_provider = ldap
ldap_sudo_search_base = ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com
#ldap_sudo_full_refresh_interval=86400
#ldap_sudo_smart_refresh_interval=3600
#min_id = 1000
#max_id = 2000
enumerate = false
More information about the sssd-users
mailing list