sssd-users July 2013

sssd-users@lists.fedorahosted.org

18 participants
15 discussions

Re: [SSSD-users] sssd and ldap based sudoers
by Licause, Al (CSC AMS BCS - UNIX/Linux Network Support) 22 Jul '13

22 Jul '13

I'm working with a customer that has implemented the sudoers schema on their ldap server and I'd like to know if there are any components that must be placed in sssd.conf to get this to work. The man sudoers.ldap only mentions ldap.conf and not sssd.conf. So to enable sudoers on ldap, do we need both sssd.conf and /etc/ldap.conf ? If this can all go in sssd.conf, which directives are necessary and what is the correct syntax ? Thanks Al Licause

5 9

FreeIPA AD Trust improvements, Fedora 19 Test Day, July 25th
by Dmitri Pal 19 Jul '13

19 Jul '13

Hello, The FreeIPA team is happy to welcome you to a Fedora Test Day that is being held on Thursday, July 25th. We would like to invite you to take part in testing of the upcoming FreeIPA 3.3 release containing 2 major improvements for easier deployment of FreeIPA Active Directory Trust feature to existing environments: 1) Use POSIX attributes defined in Active Directory [1] With previous FreeIPA releases, users coming from Active Directory to FreeIPA managed machines were always assigned POSIX attributes (UID and GID) by algorithmic mapping. However, in some deployments, Active Directory users and groups already have defined custom POSIX attribute values (UID and GID), which may then be leveraged on Linux machines via other 3rd party Active Directory integration solutions. Administrator may choose to keep the values to not disrupt file ownerships. With FreeIPA 3.3, FreeIPA Active Directory Trust may be configured to use these attributes when Active Directory user authenticates to Linux machines. 2) Expose POSIX data on legacy systems without recent SSSD Administrators may have a deployment of machines which cannot use the recent SSSD with Active Directory Trust support but would still like to be able to authenticate with Active Directory user to these machines. This may affect for example older Linux machines, UNIX machines. With FreeIPA 3.3, Administrator may configure a compatibility LDAP tree which will contain identities of the Active Directory users to the legacy systems. These systems may then leverage standard LDAP authentication in this tree allowing selected Active Directory users to authenticate. To read more about the Test Day and suggested tests, see the following link: https://fedoraproject.org/wiki/Test_Day:2013-07-25_AD_trusts_with_POSIX_att… Thank you for your help and participation! The FreeIPA team [1] http://www.freeipa.org/page/V3/Use_posix_attributes_defined_in_AD [2] http://www.freeipa.org/page/V3/Serving_legacy_clients_for_trusts

1 0

Announcing SSSD 1.10.1
by Jakub Hrozek 18 Jul '13

18 Jul '13

=== SSSD 1.10.1 === The SSSD team is proud to announce the release of version 1.10.1 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora 19 and rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * Another case where the dircache might have been created with the UID of root was fixed * Fixed a sssd_be crash in case the dynamic DNS update timed out * Several packaging bugs that were introduced as a result of splitting out the providers into separate subpackages was fixed * The SRV resolution status is now correctly reset after receiving notification about changed network conditions == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1778 Do not copy special files when creating a home directory from a skeldir https://fedorahosted.org/sssd/ticket/1814 Empty Kerberos passwords handled incorrectly https://fedorahosted.org/sssd/ticket/1827 Cannot change expired password of an AD user https://fedorahosted.org/sssd/ticket/1846 cyclic group memberships may not work depending on order of operations https://fedorahosted.org/sssd/ticket/1933 sssd fails to resolve hosts/services once the network is up https://fedorahosted.org/sssd/ticket/1935 Several translated man pages are malformed https://fedorahosted.org/sssd/ticket/1984 sssd-common requires libndr due to pac responder dependency https://fedorahosted.org/sssd/ticket/1992 AD dyndns update crashed after attempting to update a standalone DNS server https://fedorahosted.org/sssd/ticket/1999 shadowLastChange updates even when PAM reports password change failed https://fedorahosted.org/sssd/ticket/2002 cc_residual_is_used might not work correctly with dircache == Detailed Changelog == Jakub Hrozek (5): * Updating the version for the 1.10.1 release * RPM: Move sssd_pac to the krb5-common subpackage * DB: sysdb_search_user_by_name: search by both name and alias * RPM: Require libsss_idmap from sssd-common * Updating translations for the 1.10.1 release Jim Collins (1): * ldap: only update shadowLastChange when password change is successful Lukas Slebodnik (2): * Return right directory name for dircache * Every time use permissive control in function memberof_mod. Michal Zidek (1): * Always set port status to neutral when resetting service. Ondrej Kos (5): * Do not copy special files when creating homedir * KRB5_CHILD: Fix handling of get_password return code * Do not try to set password when authtok_length is zero * KRB: Handle empty password gracefully * KRB: Replace multiple calls with variable Pavel Březina (3): * print hint about password complexity when new password is rejected * dyndns timeout test: catch SIGCHLD handler events * SIGCHLD handler: do not call callback when pvt data where freed Stephen Gallagher (3): * Move pre and post scripts to sssd-common * Remove sysv->systemd upgrade routines * Move sssd_pac binary to the IPA and AD providers == Packaging Changes == * The sssd_pac binary is now owned by the IPA and AD providers * The sysv->systemd upgrade routines were removed * Several packaging fixes

1 0

Question about ldap lookup
by Mehmet Soysal 11 Jul '13

11 Jul '13

Hi, i have a short question about how ldap lookups are done and if it is possible to modify them. At the moment i have a sssd(1.9.2) up and running fine with a ldapserver. If a user tries to login with his username (ex. jsmith) or by getent command (getent passwd jsmith), sssd creates a ldap query with "uid=username". I found this in the logs: [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=jsmith)(objectclass=posixAccount))] ... ldapsearch for this user (jsmith) [...] uid: jsmith description: 2560 givenName: John objectClass: organizationalPerson objectClass: person objectClass: posixAccount objectClass: inetOrgPerson objectClass: top cn: johnsmith sn: something_else homeDirectory: /home/jsmith mail: john.smith(a)domain.tld uidNumber: 54321 gidNumber: 12345 [...] Is it possible to change the default ldap lookup from sssd, using for example "mail" or "cn" instead of uid ? So the ldap lookup which is created by sssd does not look like this: [(&(uid=jsmith)(objectclass=posixAccount))] It should look like this one: [(&(mail=jsmith)(objectclass=posixAccount))] Maybe with a conf option lookup_username_attr mail #default uid would to the job. Of Course this would fail in this situation, but a user could then login with his mailadress( john.smith(a)domain.tld ) via ssh for example, and get his usuall unixaccount "jsmith" I don`t want a mapping or rewrite of the uid field. The unixaccount name should still be filled by the uid field from ldap entry. I tried ldap_user_name = mail but then the unix account names are mapped to the mail attribute. With a second "Domain Section" a user could use both "login names" to login via ssh. His Unix Account "jsmith" and his mail adress "john.smith(a)domain.tld". Maybe someone knows if this is possible or not. Thanks in advance M.Soysal -- ---------------------------------------------------------------------------- Mehmet Soysal Scientific Computing and Services (SCS) Karlsruher Institut für Technologie (KIT) Steinbuch Centre for Computing (SCC) Zirkel 2, Gebäude 20.21, Raum 206 D-76131 Karlsruhe Tel. : +49 721 608-46347 Fax : +49 721 32550 Email: Mehmet.Soysal(a)kit.edu WWW : http://www.scc.kit.edu KIT - Universität des Landes Baden-Württemberg und nationales Forschungszentrum in der Helmholtz-Gemeinschaft

3 4

Re: [SSSD-users] Announcing SSSD 1.10.0
by Longina Przybyszewska 09 Jul '13

09 Jul '13

Thanks - and congratulations ! But, what does it mean in practice for multi domain AD environment that "Global Catalog is searched for identity information"? Can we drop ldap search per domain? Is that search full compatible with with ldap/domain search? Is then autofs/automount support fully integrated in sssd since 1.10.0? No need for automount attributes in AD's ldap? I would need that version implementation in Ubuntu - do you know which Ubuntu distribution would go with it? Best, Longina

7 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users July 2013