sssd-users July 2014

sssd-users@lists.fedorahosted.org

26 participants
17 discussions

1.12.0 configure error
by steve 15 Jul '14

15 Jul '14

openSUSE 13.1 configure: error: Please install libini_config development libraries. libini_config libraries are necessary for building ipa provider, as well as for building gpo-based access control in ad provider. If you do not want to build these providers it is possible to build SSSD without them. In this case, you will need to execute configure script with argument --without-samba rpm -q libini_config-devel libini_config-devel-0.6.1-15.1.2.i586 Not recent enough? Cheers, Steve

3 8

LDAP access provider - list of groups in directory?
by John Snowdon 11 Jul '14

11 Jul '14

Hi, I'm currently working on an sssd configuration to replace a set of legacy authentication and authorization mechanisms on several hundred Linux systems in our department - they're currently supported via shared /etc/passwd and /etc/group files. I've got access, user and group information all working well via pam and sssd and am now trying to find a solution to the authorisation requirements. Previously this was managed via puppet-distributed changes to /etc/pam.d with a list of users/groups per machine stored in the puppet nodes files. I'd like to move to a setup where each machine (or class of machine) just pulls the list of allowed unix groups from it's own node in OpenLDAP. Is there anything available in sssd.conf that would allow the ldap access provider to pull back a list of allowed groups from ldap, rather than listing them explicitly? Sort of a hybrid between the simple_allow_groups and ldap_access_filter? e.g. What I would love to do access_provider = ldap ldap_allow_groups_dn = cn=MachineA,ou=machines,dc=network,dc=com Where the cn=MachineA object is a groupOfNames that would look something like: objectClass: groupOfNames objectClass: top cn: MachineA description: Posix groups whose users are allowed to access MachineA member: root member: localusers member: adminusers member: webusers I'd much rather have the lists of groups allowed to access a machine managed from LDAP, rather than directly coded into sssd.conf, or alternatively, via pam_listfile. Is there any way of enabling this in the current version of sssd, or emulating it somehow via ldap_access_filter? Cheers, John

6 16

Re: [SSSD-users] 1.12.0 configure error
by John Hodrien 11 Jul '14

11 Jul '14

On 11 Jul 2014 11:53, steve <steve(a)steve-ss.com> wrote: > rpm -q libini_config-devel > libini_config-devel-0.6.1-15.1.2.i586 > > Not recent enough? I thought it needed 1.1. The rpm spec file in contrib can confirm. jh

3 3

Re: [SSSD-users] 1.11.5 ddns failure on Ubuntu 14.04[SOLVED]
by Longina Przybyszewska 09 Jul '14

09 Jul '14

I installed another machine, using the same procedure as for the previous one; DNS entry is created, but dyndns updates fail exactly as for the first one: both machines discover the same active DNS server, to which try to send updated A records (I have no access to the log, but asked my AD-admins colleges to look into). sssd.conf : [nss] debug_level = 9 filter_groups = root filter_users = root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd [sssd] debug_level = 6 domains =nat.domain.org config_file_version = 2 services = nss, pam [domain/nat.domain.org] debug_level = 7 ad_domain = nat.domain.org krb5_realm = NAT.DOMAIN.ORG realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad auth_provider = ad access_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = True fallback_homedir = /home/%d/%u # dyndns_update = true Best Longina -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of steve Sent: 20. juni 2014 17:42 To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] 1.11.5 ddns failure on Ubuntu 14.04[SOLVED] (fwd) On Fri, 2014-06-20 at 07:37 +0000, Longina Przybyszewska wrote: > > The same happened to the keytab file. Here the right one, corresponding to the log file. > 2 05/19/2014 10:36:55 SKYWALKER$(a)NAT.DOMAIN.ORG > Hi And the corresponding sssd.conf? Anyway, sssd is sending the correct stuff to nsupdate for the forward rr but the log ends there, so assuming it fails for the reverse too. Another good way of debugging it is to perform the update by hand using nsupdate -g Do you have access to the AD dns logs? HTH Steve _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

4 29

Announcing SSSD 1.12.0
by Jakub Hrozek 09 Jul '14

09 Jul '14

=== SSSD 1.12.0 === The SSSD team is proud to announce the release of version 1.12.0 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora 21 and rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * A new responder, called InfoPipe was added. This responder provides a public D-Bus interface accessible over the system bus. In this release, methods for retrieving user attributes and list of groups were added as well as objects representing SSSD domains and processes. The next 1.12.x releases will publish objects representing users and groups, too. * SSSD provides an ID-mapping plugin for cifs-utils so that Windows SIDs can be mapped onto POSIX IDs and/or names without requiring Winbind and using the same code as the SSSD uses for identity information. * First phase of Group Policy-based access control for the AD provider was added. At the moment, the gpo-ldap component that downloads the list of GPOs that apply for the specific client has been implemented as well as the gpo-smb component that retrieves the group policy files and determines the access control check results based on those files. Future improvements will focus on storing the GPO policies as local files and mapping the Windows logon rights onto Linux PAM services. * journald can now be used to store debug logs. The journald support is not enabled by default. In order to enable it, compile SSSD with --with-syslog=journald. * Added a new library called sss_sifp that provides a simple synchronous API for communication with our new InfoPipe responder over the system bus. * SSSD now works fine on systems that use Python 3 as their default interpreter, however, having Python 2 installed is still required. * Several patches that improve portability of SSSD, especially with consideration of BSD systems have been included * It is now possible to re-use a single LDAP attribute for several attribute mappings in sssd.conf. This enhancement is useful for environments that need to use a single ID number for both UID and GID. == Packaging Changes == * The sssd_sifp library and the InfoPipe responder are packaged in their own subpackages == Documentation Changes == * A new option ldap_use_tokengroups was added. Setting this option to False disables the support for tokenGroups, which is useful for environments that wish to restrict the group nesting level. Doing so with tokenGroups enabled is nontrivial since the tokenGroups attribute flattens the group memberships. * A new option homedir_substring makes it possible to substitute a templatized home directory attribute for a client-side defined value * The new InfoPipe responder has several configuration options. Refer to the sssd-ifp manual page for details. * A new option offline_timeout was added. This option allows the administrator to configure how often should SSSD attempt to reconnect when in offline mode * The LDAP provider has a new option ldap_user_extra_attrs that enables the administrator to extend the map of attributes downloaded when looking up a user. These custom attributes can then be retrieved with the new DBus API. * The automounter master map name can now be configured with a new option ldap_autofs_map_master_name. * A new option ad_gpo_access_control is available to let the user configure the behaviour of the GPO access control feature. == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1096 Clock skew in krb5 auth should result in offline operation, not failure https://fedorahosted.org/sssd/ticket/1187 Delete IPA specific attribute mappings from man page https://fedorahosted.org/sssd/ticket/1366 [RFE] Optimize RFC2307bis lookups when user and group search bases do not overlap https://fedorahosted.org/sssd/ticket/1451 Update manpage with the minimal value expected for ldap_idmap_range_size https://fedorahosted.org/sssd/ticket/1534 [RFE] Integrate SSSD with CIFS client https://fedorahosted.org/sssd/ticket/1585 [RFE] Add a check to pam_sss to ensure that authtok_type=SSS_AUTHTOK_TYPE_PASSWORD is \0 terminated https://fedorahosted.org/sssd/ticket/1718 Offline mode timeout not documented https://fedorahosted.org/sssd/ticket/1866 SSSD changes primary creds on authentication https://fedorahosted.org/sssd/ticket/1885 Use a shorter retry timeout for SRV queries in cases the query cannot be resolved (negative timeout) https://fedorahosted.org/sssd/ticket/1918 Undocument and deprecate ipa_hbac_support_srchost https://fedorahosted.org/sssd/ticket/1923 Create tickets to track unit test enhancements https://fedorahosted.org/sssd/ticket/2022 Review Fedora 20 system wide changes and file corresponging tickets if they affect SSSD https://fedorahosted.org/sssd/ticket/2024 Create unit test for nested groups https://fedorahosted.org/sssd/ticket/2037 nondescriptive error message when ccache directory has wrong permissions https://fedorahosted.org/sssd/ticket/2040 Enable ad_compat sasl option https://fedorahosted.org/sssd/ticket/2061 ccache mangament simplification https://fedorahosted.org/sssd/ticket/2072 [RFE] Provide an experimental DBus responder to retrieve custom attributes from SSSD cache https://fedorahosted.org/sssd/ticket/2073 [RFE] Extend the LDAP backend to retrieve extended set of attributes https://fedorahosted.org/sssd/ticket/2084 check for active sessions not troll proc for uids https://fedorahosted.org/sssd/ticket/2094 find uid tests fail https://fedorahosted.org/sssd/ticket/2097 Build library libsss_test_common in test phase https://fedorahosted.org/sssd/ticket/2125 cifsidmap support should be optional https://fedorahosted.org/sssd/ticket/2162 [RFE] warn to syslog if an unresponsive subprocess is terminated https://fedorahosted.org/sssd/ticket/2171 Do not start multiple backends for the same domain https://fedorahosted.org/sssd/ticket/2179 Sssd dyndns update fails for addresses from different networks https://fedorahosted.org/sssd/ticket/2195 [RFE] Send debug logs to journald by default https://fedorahosted.org/sssd/ticket/2198 remove unused tmp_ctx in async_resolv.c https://fedorahosted.org/sssd/ticket/2210 convert ad_account_can_shortcut to returning boolean https://fedorahosted.org/sssd/ticket/2225 PO files changed during build https://fedorahosted.org/sssd/ticket/2227 [RFE] Expose domain object over DBus https://fedorahosted.org/sssd/ticket/2234 autogenerate introspection https://fedorahosted.org/sssd/ticket/2254 [RFE] Create a library to simplify usage of D-Bus responder https://fedorahosted.org/sssd/ticket/2258 [src/providers/krb5/krb5_common.c:418] -> [src/providers/krb5/krb5_common.c:418]: (style) Same expression on both sides of '||'. https://fedorahosted.org/sssd/ticket/2288 sssd is crashing after several quick invokes of automount -m https://fedorahosted.org/sssd/ticket/2290 The DBus responder should not spawn a client socket https://fedorahosted.org/sssd/ticket/2291 make distcheck fails https://fedorahosted.org/sssd/ticket/2304 refactor splitting the selinux priority list https://fedorahosted.org/sssd/ticket/2313 consider going offline on KRB5KRB_ERR_GENERIC error instead of System Error https://fedorahosted.org/sssd/ticket/2319 provide a compatible definition of ck_assert_uint_eq https://fedorahosted.org/sssd/ticket/2321 daemon FAILS to start with config file set to mode 400 https://fedorahosted.org/sssd/ticket/2331 sssd should also filter out S-1-18 https://fedorahosted.org/sssd/ticket/1503 Document the IPC between different SSSD processes https://fedorahosted.org/sssd/ticket/2182 [RFE] Add the possibility to add custom attributes for the local provider https://fedorahosted.org/sssd/ticket/2308 document that simple access provider supports group nesting https://fedorahosted.org/sssd/ticket/1359 clang reports possible alignment issues https://fedorahosted.org/sssd/ticket/2056 Add a sysdb utility call sysdb_attrs_add_lower_case_string https://fedorahosted.org/sssd/ticket/2149 Add a contrib script to prepare two SRPMs for covscan-diff https://fedorahosted.org/sssd/ticket/2184 LDAP searches are not able to reuse one LDAP attribute for multiple sysdb attributes https://fedorahosted.org/sssd/ticket/2185 cleanup redundant #define statements https://fedorahosted.org/sssd/ticket/2194 Use version script file for libraries from sssd https://fedorahosted.org/sssd/ticket/2209 Rename label in users_get_send/groups_get_send https://fedorahosted.org/sssd/ticket/2341 sssd-ldap handles redundant group members incorrectly https://fedorahosted.org/sssd/ticket/2347 sbus_codegen_tests leaves processes running https://fedorahosted.org/sssd/ticket/2348 debugging on the foregound does not work https://fedorahosted.org/sssd/ticket/2352 The es and fr translations on Transifex are malformed https://fedorahosted.org/sssd/ticket/2356 Use python2 in shebang for python scripts == Detailed Changelog == Alexander Bokovoy (3): * FAST: when parsing krb5_child response, make sure to not miss OTP message if it was last one * ipa subdomains provider: make sure search by SID works for homedir * well known sids: Windows Server 2012 new asserted identity SIDs Alexey Shabalin (1): * Use KRB5_CFLAGS where appropriate Aron Parsons (1): * do not use default_domain_suffix with autofs Benjamin Franzke (4): * Add CIFS idmap plugin * dlopen-tests: Check the result of asprintf * BUILD: Use OPENLDAP_CFLAGS instead of LDAP_CFLAGS * BUILD: Link libsss_krb5_common.so to libkeyutils.so Chris Leick (1): * German translation update Cove Schneider (1): * Add ldap_autofs_map_master_name option Jakub Hrozek (209): * Bump version to track 1.12 development * KRB5: Call umask before mkstemp in the krb5 child code * Add journald support * BE: Log domain name to journald if available * AD: async request to retrieve master domain info * LDAP: sdap_id_setup_tasks accepts a custom enum request * AD: Download master domain info when enumerating * MAN: Fix provider man page subtitle * LDAP: Deprecate ldap_{user,group}_search_filter * AD: Failure to get flat name is not fatal * Check return values of setenv and unsetenv * Convert IN_MULTICAST parameter to host order * NSS: Set UID and GID to negative cache after searching all domains * NSS: Failure to store entry negative cache should not be fatal * KRB5: Fix bad comparison * IPA: Ignore dns_discovery_domain in server mode * KRB5: Return ERR_NETWORK_IO when trusted AD server can't be resolved * KRB5: Use the correct domain when authenticating with cached password * LDAP: Require ID numbers when ID mapping is off * LDAP: Allow searching subdomain during RFC2307bis initgroups * AD: talk to GC first even for local domain objects * MAN: Document that POSIX attributes must be replicated to GC * krb5: Fix unit tests * INI: Disable line-wrapping functionality * MAN: Fix refsect-id * KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD user * PROXY: Fix memory hierarchy when enumerating services * Include external headers with #include <foo.h> * Remove unused constants * IPA: Do not enable IPA sites in server mode * Remove duplicate declaration * UTIL: Move sss_parse_name_for_domains declaration to util.h * Inherit ID limits of parent domains if set * SYSDB: Add sysdb_delete_by_sid * LDAP: Delete entry by SID if not found * LDAP: Amend sdap_access_check to allow any connection * LDAP: Parse FQDN into name/domain for subdomain users * AD: Add a new option ad_access_filter * AD: Use the ad_access_filter if it's set * AD: Search GC by default during access control, fall back to LDAP * AD: Add extended access filter * TEST: Test getgrnam with emphasis on members * NSS: Print FQDN for groups with mixed domain membership * KRB5: Handle ERR_CHPASS_FAILED * NSS: Fix service enumeration * NSS: Use new safealign macros in NSS responder * MAN: Document that krb5 directories can only be created as private * LDAP: Check all search bases during nested group processing * NSS: Fix parenthesis * AD: Fix ad_access_filter parsing with empty filter * UTIL: Free log message when using journald * Initialize sid_str to NULL to avoid freeing random data * Remove unused variable * PAC: Free config attribute when it's processed * Merge ipa_selinux_common.c and ipa_selinux.c * SYSDB: Drop the sysdb_ctx parameter from the autofs API * SYSDB: Drop the sysdb_ctx parameter from SELinux functions * SYSDB: Drop the sysdb_ctx parameter from the sysdb_idmap module * SYSDB: Drop the sysdb_ctx parameter from the sysdb_sudo.c module * LDAP: Initialize user count for AD matching rule * LDAP: Split out a request to search for a user w/o saving * LDAP: Search for original DN during auth if it's missing * AD: Fix a typo in the man page * KRB5: Go offline in case of clock skew * MAN: Add a link explaining different LDAP scopes * MAN: Remove unused experimental file * NSS: Compare bool with false, not 0 * Fix a trivial typo * LDAP: Fix a debug message * SUBDOMAINS: Reuse cached results if DP is offline * AD: Don't mark domain as enumerated twice * AD: Refresh subdomain data structures on startup * IPA: Refresh subdomain data structures on startup * IPA: Call ipa_ad_subdom_refresh when server mode is initialized * AD: Add a utility function to create list of connections * AD: Add a new option to turn off GC lookups * AD: Enable fallback to LDAP of trusted domain * LDAP: Fix typo and use the right attribute map * LDAP: Add a new error code for malformed access control filter * tests: Remove tests that check creating public directories * UTIL: Inherit parent domain's default_shell * NSS: Use plain user name when expanding homedir * AD: Don't fail the request if ad_account_can_shortcut fails * MAN: Fix a typo * LDAP: Fix error check * LDAP: Don't abort request if no id mapping domain matches * AD: Store info on whether a subdomain is set to enumerate * LDAP: Pass a private context to enumeration ptask instead of hardcoded connection * LDAP: Add enum request with custom connection * AD: Enumerate users from GC, other entities from LDAP * LDAP: Don't clobber original_member during enumeration * DB: Add sss_ldb_el_to_string_list * AD: Establish cross-domain memberships after enumeration finishes * MAN: clarify which shell option takes precedence * NSS: Fix DEBUG formatting of cmdctx->id * SSS_CACHE: Reset the initgroups attribute when resetting users * LDAP: Detect the presence of POSIX attributes * AD: Only download domains that are set to enumerate * AD: Remove dead code * LDAP: Handle errors from sdap_id_op properly in enum code * IPA: Default to krb5_use_fast=try * MAN: Clarify the new krb5_use_fast IPA default * DEBUG: Fix build without journald * NSS: Continue if there is no port * IPA: Don't call tevent_req_post outside _send * IPA: Don't fail if apply_subdomain_homedir returns ENOENT * Fix DEBUG message formatting * OPTS: Allow using defaults for blobs * DP: Provide separate dp_copy_defaults function * MAN: Clarify the ldap_access_filter option further * MAN: Clarify that changing ID mapping options might require purging the cache * IPA: Do not save intermediate data to sysdb * AD: Only connect to GC for subdomain users * MAN: Clarify the GC support a bit * IPA: Use the correct domain when processing SELinux rules * IPA: Write SELinux usernames in the right case * KRB5: Do not attempt to get a TGT after a password change using OTP * AD: connect to forest root when downloading the list of subdomains * IPA: Fix SELinux mapping order memory hierarchy * IFP: Fix a typo in the Makefile * IFP: Re-add the InfoPipe? server * IFP: Connect to the system bus * tests: Don't set the check fork mode explicitly * SBUS: Generate introspection from the interface meta structure * ConfigAPI: Add two missing AD options * Add a unit test for sss_parse_name_for_domains * Minor fixes for sss_parse_name_for_domains * SBUS: Create an sbus_method_meta instance for Introspection * RESPONDER: Fix a wrong DEBUG message * DP: Remove unused 'force' parameter from the subdomain handler * TESTS: Create a default sss_names_ctx in create_dom_test_ctx * TESTS: Split a separate common_mock_resp_dp module * RESPONDERS: Add a new request sss_parse_inp_send * KRB5: Print a verbose error message on failure reading the keytab * LDAP: Fix off-by-one bug in sdap_copy_opts * LDAP: Make it possible to extend an attribute map * IFP: Close memstream handle in introspect destructor * LDAP: Check the LDAP handle before using it * SBUS: several trivial style fixes * SBUS: Fix error handling condition * SBUS: Add a convenience function sbus_error_new * SBUS: Split out dbus_conn_send * SBUS: Add SBUS_CONN_TYPE_SYSBUS * SBUS: Add an async request to retrieve the caller ID * SBUS: Refactor sbus_message_handler to retrieve caller ID * IFP: Add utility functions * IFP: use a list of allowed_uids for authentication * IFP: Initialize negative cache timeout * IFP: Add GetUserAttrs? call * AD: Do not remove non-root domains when looking up root domain * IFP: Per-attribute ACL for users * SBUS: Allow registering paths with fallback * SYSDB: return SYSDB_NAME from sysdb_initgroups * IFP: Add a GetGroupsList? method * AD: Initialize user_map_cnt in server mode * IFP: Add utility functions to escape and unescape object paths * IFP: Add a unit test for ifp_reply_objpath * SBUS: Utility function sbus_request_return_as_variant * IFP: Allow Set, Get and GetAll? from DBus.Properties * SBUS: Implement org.freedesktop.DBus.Properties.Get for primitive types * SBUS: Return / if an object path getter returns NULL * SBUS: Add several error constant definitions * SBUS: Add org.freedesktop.DBus.Properties.Get to Introspection * IFP: Support multiple interfaces on sysbus * SBUS: Add utility function sbus_add_variant_to_dict * SBUS: Consolidate VTABLE_FUNC definitions in sssd_dbus_meta.h * SBUS: Implement org.freedesktop.DBus.Properties.GetAll? for primitive types * SBUS: Add org.freedesktop.DBus.Properties.GetAll? to Introspection * TESTS: check allocation result * TESTS: check dbus mock result * IFP: Add ListDomains? and FindDomainByName? * tests: Add test for confdb_list_all_domain_names * tests: Add test for get_known_services * BUILD: Disable dbus tests when running distcheck * MAN: Add sssd-ifp to the list of translatable manual pages * Updating the translations for the 1.12 beta1 release * Updating the version to 1.12beta2 * TOOLS: Allow adding and modifying custom attributes with sss_usermod * TESTS: fgetc returns int, not char * MAN: Fix a typo in the ldap_id_mapping page * LDAP: Fix DEBUG message * Updating the translations for the 1.12beta2 release * Updating the version for the 1.12.0 stabilization * LDAP: Fix retrieving a group with no members * TESTS: Add confdb domain base DN to sss_test_ctx * TESTS: Use the right confdb path * TESTS: Fix group search base * TESTS: Do not require replies from mocked sdap_get_generic_recv to be talloc contexts * TESTS: Change how mock_sysdb_user() is implemented * TESTS: Add more tests for nested groups processing * TESTS: Do not rely on order of hash items * PROVIDERS: Add ldap_common.h to opts.h of each provider * TESTS: Add a unit test for the sdap.c module * LDAP: Try all attributes when saving an entry * SDAP: Fix DEBUG message priorities in sdap_parse_entry * LDAP: Remove unused output parameter _dn from sdap_parse_entry * SDAP: Remove unused function sdap_get_msg_dn * SDAP: Free bervals on failure in sdap_parse_entry * BUILD: dbusintrospectdir is not used anymore * IFP: Fix DEBUG messages * IFP: Return a specific value on failure connecting to the system bus * IFP: Provide a SBUS method to reconnect to sysbus * MONITOR: Signal InfoPipe? to reconnect on SIGUSR2 * TOOLS: New helper tool sss_signal * BUILD: Add the DBus service activation * SSSD: Send debug to stderr when running on foreground * TOOLS: Always debug to stderr * Updating translations for the 1.12.0 release * Updating the version for the 1.12.0 release Jan Cholasta (1): * SSH: Allow newline at the end of public key values in LDAP Jan Engelhardt (1): * build: fix ordering of linker flags Lukas Slebodnik (167): * Add missing new line in DEBUG message * LDAP: Use primary cn to search netgroup * RESPONDER: Use right function prototype * Revert "mmap_cache: Skip records which doesn't have same hash" * mmap_cache: Use two chains for hash collision. * Include right header file * Include header file in implementation module. * krb5: fix warning may be used uninitialized * LDAP: Set default value for dyndns update to false * krb5: Remove warning dereference of a null pointer * krb5: Use right function to free data. * IPA: Remove unused memory context. * AD: Prefer GC port from SRV record * AD: fall back to LDAP if GC is not available. * tests: Use right format string for type size_t * Makefile: Add missing libraries * Makefile: Remove unused variable TEST_MOCK_OBJ * LDAP: Return correct error code * NSS: Set packet length for initgroups * BUILD: Explicitly link libsss_ad.so with sasl libs * BUILD: Change error message if missing cifsimap.h * LDAP: Prevent from using uninitialized sdap_options * monitor: return right error code * SYSDB: Skip malformed netgroup attribute. * TESTS: Link libsss_test_common with tevent * TESTS: Remove test dir after successful tests * Remove unused parameter from sss_selinux_extract_user * Remove unused parameter from get_user_dn * Remove unused parameter from sdap_save_user * Remove unused parameter from sdap_get_members_with_primary_gid * Remove unused parameter from sdap_store_group_with_gid * Remove unused parameter from sdap_add_group_member_2307 * Remove unused parameter from sdap_process_missing_member_2307 * Remove unused parameter from sdap_save_netgroup * Remove unused parameter from krb5_auth_cache_creds * Remove unused parameter from krb5_auth_store_creds * Remove unused parameter from mod_groups_member * Remove unused parameter from usermod * Remove unused parameter from groupmod * Remove unused parameter from useradd * Remove unused parameter from groupadd * Remove unused parameter from invalidate_entry * Remove unused parameter from search_autofsmaps * Remove unused parameter from seed_domain_user_info * Remove unused parameter from sudosrv_get_sudorules_query_cache * Remove unused parameter from delete_user * Remove unused parameter from save_user * Remove unused parameter from save_netgroup * Remove unused memory context in proxy * Remove unused parameter from ipa_save_netgroup * Remove unused parameter from group_show_mpg * Remove unused parameter from group_show_trim_memberof * AUTOMAKE: Don't build libsss_test_common every time * SYSDB: Sanitize filter before sysdb_search_groups * SYSDB: Sanitize filter before removing ghost attrs * NSS: Fix memory leak in sss_setnetgrent * AUTOTOOLS: krb5 1.12 is also supported krb5 libs * TESTS: Fix build with older version of check framework * AD: Return right error code from netlogon_get_flat_name * LDAP: Don't fail if subdomain cannot be found by sid * LDAP: update id mapping detection for ldap provider * sdap_idamp: Fall back to another method if sid is wrong * TESTS: Fix authtok test for zero length string. * CLIENT: Remove unused macros * LDAP: store group if subdomain cannot be found by sid * LDAP: require attribute groupType for AD groups * AD: Remove unused memory contexts * memberof: Removed unused parameter from mbof_fill_vals_array. * Makefile: Remove unused libraries * DOC: Fix names of arguments in doxygen comments * test_dyndns: Test right variable after allocation. * IPA: explicitly link libsss_ipa with selinux library * Translation: Move german translation to right directory * SPEC: Fix packaging rpms on OSes without systemd * DEBUG: Fix crash after fallback from journal log * Fix warning unused variable ap_fallback * LDAP: Setup periodic task only once. * UTIL: Sanitize whitespaces. * KRB5: Fix condition for empty string * NSS: Fix warning access array with index then check * TEST: Fix warning invalid printf argument type * Remove unused structures. * TEST: Use unique directory for negcache test * PAM: Test return value of strdup * Makefile: Add missing library to the dp_opt_tests * AD: Continue if sssd failes to check extra members * TEST: Remove unused argument sysdb_path * TEST: Use right domain name in negcache test * TEST: Do not clean up if test fail. * hbac-test: Use defined macros instead of strings * TESTS: Remove unused macros * KRB: Prevent dereference of a null pointer * UTIL: Hide implementation details about unicode libraries. * Use pattern #elif defined(identifier) * BUILD: Enable additional compiler warnings * SYSV: Do not call functions success and fail itself * IPA: Use function sysdb_attrs_get_el in safe way * AUTOFS: terminate array after the last entry * Makefile: Use alternative method to replace *bindir * krb5_child: Remove unused krb5_context from set_changepw_options * Remove unused argument from resolv_gethostbyname_dns_parse * Fix warning zero-length gnu_printf format string * krb5_child: Fix use after free in debug message * AUTOMAKE: Do not include generated files into tarball * BUILD: Link libsss_ldap_common.so to libsss_idmap.so * BUILD: Move file find_uid.c into libsss_util.so * BUILD: Move file sss_krb5.c into libsss_krb5_common.so * BUILD: Move duplicated files from providers to libsss_ldap_common.so * TEST: Add untested libraries into dlopen test * TEST: Some macros aren't defined in older version of check. * CRYPTO: Fix access to uninitialized data * SPEC: Remove duplicate sssd_ifp. * TEST: Link ipa_ldap_opt test with openldap libs * UTIL: Use constant instead of value for stdin. * MONITOR: Fix start up with empty standard input * SPEC: Add libsss_ad_common.so to the package sssd-ad * TEST: Refactor test_io * BUILD: Make samba4 libraries optional * SBUS: Fix warning declaration shadows a global declaration * PAM: Fix problem with missing declaration. * PAM: macro PAM_DATA_REPLACE isn't available in openpam. * CRYPTO: Use unprefixed version of function stpncpy * CONFIGURE: Remove duplicate detection of pam * Remove unused parameter from ifp_user_get_attr_handle_reply * Remove unused parameter from ifp_user_get_groups_reply * resolv: Do not try to free addrinfo in case of error * AUTOCONF: Move detection of samba libraries to one file * SBUS: Define DBUS_ERROR_INIT for old version of dbus * SBUS: Include config.h for enabling function in stdio.h * UTIL: Fix order of header files. * LDAP: Don't use macro _XOPEN_SOURCE for extra features * UTIL: Include netinet/in.h for ip adress macros * TEST: Test empty results from functions sysdb_search_* * sss_autofs: Check return value of autofs make request * sss_autofs: Do not try to free empty autofs context * Don't use macro _XOPEN_SOURCE for function strptime * TEST: Add libsss_simpleifp.so to dlopen test * man: Substitute entity values for entity references * MAKE: Link libsss_ldap.so with ldap libraries * UTIL: Add function sss_parse_name_const * NSS: Refactor expand_homedir_template * NSS: Add option to expand homedir template format * TEST: Add test for expand homedir * PAM: Include header file security/pam_appl.h * MAKE: Remove PAM libraries from libsss_simple * CONFIGURE: Enhance detection of pam * PAM: Fix compilation of pam_test_client with openpam * PAM: Use fallback version of some pam macros * PAM: Define compatible macros for some functions. * PAM: add ignore_authinfo_unavail option * SDAP: Use portable constant as level in setsockopt * Unify usage of function gethostname * MAN: Add reference to manual page sssd-sudo * Use python2 in shebang for python scripts. * CONFIGURE: Prefer python2 * SYSDB: Remove useless NULL test. * SYSDB: Modify declaration of sysdb_search_entry * TESTS: Fix format string in check macros * BUILD: ad_gpo_tests should be built only with samba * SPEC: Add gpo_child to package sssd-ad * UTIL: Fix access out of bound in parse_args * BUILD: Add version symbol files for public libraries. * sdap-tests: Fix off by one. * BUILD: Link sdap-tests with openldap libraries * PAM: Test right variable after calling sss_atomic_read_s * CONTRIB: make_srpm.sh can prepare SRPM with patches * CONTRIB: Fix creation of tar.gz with old version of git Markos Chandras (2): * sysv/gentoo: Use xdm if possible * sysv/gentoo: Send debug output to a file instead of stderr Michal Zidek (31): * Rename _SSS_MC_SPECIAL * man sssd: Add note about SSS_NSS_USE_MEMCACHE * nss: Wrong debug message. * util: Add functions to check if IP addresses is special * dyndns: Use check_ipvX_addr functions * sdap_async_sudo_hostinfo.c: Use check_ipvX_addr * tests: Silence alignment warning in tests. * responder: Access packet header using SAFEALIGN macros. * confdb: Make offline timeout configurable * SYSDB: Drop the sysdb_ctx parameter from the sysdb_search module * SYSDB: Drop the sysdb_ctx parameter from the sysdb_services module * SYSDB: Drop the sysdb_ctx parameter from the sysdb_ssh module * SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 1) * SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 2) * SYSDB: Drop redundant sysdb_ctx parameter from sysdb.c * sss_client: Use SAFEALIGN_SETMEM_<type> macros where appropriate. * krb5: Alignment warning reported by clang * monitor: Stop using unnecessary helper pointer. * Missing parameter name in declaration. * Fix parameter name. * sss_client: Use SAFEALIGN_COPY_<type> macros where appropriate. * responder: Use SAFEALIGN macro when checking pam data validity. * Properly align buffer when storing pointers. * responder: Use SAFEALIGN macros where appropriate. * Possible null dereference in SELinux code * Remove dead code from ipa_get_selinux_recv * mmap: Get errno when unlink fails * ipa_selinux: Put SELinux map order related variables into structure * Add type parameter to DISCARD_ALIGN macro * Suppress safealign warnings with DISCARD_ALIGN. * Use DISCARD_ALIGN in VTABLE_FUNC macro Nathaniel McCallum (1): * Fix krb5 changepw when FAST-only preauth methods are used (like OTP) Nikolai Kondrashov (23): * dyndns: Update PTR records separately * Add cscope inverted index files to .gitignore * Update debug levels in sss_semanage_error_callback * Move DEBUG macro body to debug_fn * Remove extra flushing from debug message output * Cleanup debug_fn * Make DEBUG macro definition variadic * Make DEBUG macro invocations variadic * Fixup DEBUG macro invocations update * Update DEBUG* invocations to use new levels * Update debug level in sysdb_check_upgrade_02 * Remove DEBUG macro support for old debug levels * Use HW instead of processor name as build arch * Use functions, not aliases in bashrc_sssd * Handle unbound variables in bashrc_sssd * Clarify CFLAGS handling in bashrc_sssd * Remove --with-distro-version * build: Don't assume systemd implies journald * build: List test extensions * build: Switch to AM_DISTCHECK_CONFIGURE_FLAGS * build: Switch back to DISTCHECK_CONFIGURE_FLAGS * build: Augment systemdconfdir at configure stage * build: Allow augmenting TESTS_ENVIRONMENT Ondrej Kos (2): * MAN: Remove IPA specific LDAP settings * IPA: Deprecate ipa_hbac_support_srchost option Pallavi Jha (5): * added null checks to authtok module * permament is corrected to permanent * cmocka unit test for authtok module added * Unit-test-for-negcache-module-added * cmocka-unit-test-for-functions-getpwuid*-added Pavel Březina (94): * util: add sss_idmap_talloc[_free] * simple access tests: fix typos * simple provider: support subdomain users * util: add find_subdomain_by_sid() * util: add find_subdomain_by_object_name() * simple provider: support subdomain groups * simple access test: initialize be_ctx for all tests * simple provider: obey case sensitivity for subdomain users and groups * man: improve sssd-sudo manual page * man: server side password policies always takes precedence * util: add get_domains_head() * sysdb: get_sysdb_grouplist() can return either names or dn * sysdb: sysdb_update_members can take either name or dn * ad: store group in correct tree on initgroups via tokenGroups * sudo: allow specifying only one time restriction * sudo: improve time restrictions debug messages * nss: wait for initial subdomains request to finish * subdomains: first destroy ptask then remove sdom * dp: make subdomains refresh interval configurable * dp: store list of ongoing requests * utils: add ERR_DOMAIN_NOT_FOUND error code * dp: set request domain * dp: add function to terminate request of specific domain * dp: free sdap domain if subdomain is removed * be_ptask: add be_ptask_create_sync() * dp: convert cleanup task to be_ptask * ipa: destroy cleanup task when subdomain is removed * ad: destroy ptasks when subdomain is removed * sdap_save_user: try to determine domain by SID * sdap_save_group: try to determine domain by SID * free sid obtained from sss_idmap_unix_to_sid() * ad: shortcut if possible during get object by ID or SID * sdap: store base dn in sdap_domain * sdap: add sdap_domain_get_by_dn() * ghosts: pick correct domain for every member * sdap_fill_memberships: pick correct domain for every member * nested groups: pick correct domain for cache lookups * idmap: add API to free allocated SIDs * free idmapped SIDs correctly * free idmapped dom SIDs correctly * free idmapped smb SIDs correctly * free idmapped binary SIDs correctly * pac: fix double free * pac: fix potential memory leaks * failover: check dns_domain if primary servers lookup failed * ad: refactor tokengroups initgroups * ad: use tokengroups even when id mapping is disabled * Bump sss_idmap version to 3:0:3 * sudo: memset tm when converting time attributes * resolv_gethostbyname_dns_parse(): remove tmp_ctx * IPA: default krb5_fast_principal to host/$client@$realm * sdap: move non async functions from sdap_async.c to sdap_utils.c * sdap: move non async functions from sdap_async_connection.c to sdap_utils.c * sdap: move sdap_get_id_specific_filter() to sdap_utils.c * ldap: move options related content from ldap_common.c to ldap_options.c * ldap: move domain related content from ldap_common.c to sdap_domain.c * make make_realm_upper_case() static * tests: add confdb_path to sss_test_ctx * tests: mock SDAP * tests: mock sysdb users and groups * tests: prepare makefile for provider related unit tests * tests: new macro sss_will_return_always * tests: nested groups unit test * tests: don't print debug message when test dir does not exist * ad_account_can_shortcut(): return bool instead of errno * IFP: do not create client socket * sbus_tests: fix missing invoker in initializer * sbus request: fix error initialization * SBUS: remove unused variables * sss_config: the code * sss_config: build * sss_config: unit tests * sss_config: build only when IFP is allowed * IFP: Add a utility function to reply with an object path * SBUS: Utility function sbus_request_return_array_as_variant * SBUS: Return empty string if a string getter returns NULL * SBUS: Add utility function sbus_add_array_as_variant_to_dict * IFP: Implement domain getters * confdb: add confdb_list_all_domain_names() * utils: add get_known_services() * IFP: Implement SSSD components * sss_sifp: introduce API * sss_sifp: implement API * sss_sifp: build * sss_sifp: unit tests * sss_sifp: add support for string dictionary * sss_sifp: add shortcuts for common use cases * man: clarify refresh_expired_interval * sbus_codegen_tests: free memory context * nested groups: do not fail if we get one entry twice * sbus_request: fix potential NULL dereference * sss_sifp: pkg-config requires is a comma separated list * sss_sifp: add prefix and exec_prefix to pkg-config * IFP: touch config when changing debug level temporarily Pavel Reichl (64): * Include ext headers with #include <foo.h> - cont * monitor: Specific error message for missing sssd.conf * SSSD: Improved domain detection * SSSD: Unit test - sss_ldap_dn_in_search_bases * monitor: use-after-free bugfix * monitor: monitor_kill_service - refactor * monitor: memory-leak bug * monitor: syslog when process killed by monitor * SYSDB: typos & debug macro constants * SYSDB: missing conversion of LDB error to errno * SYSDB: simplification of condition in if statement * responder: Set forest attribute in AD domains * simple access: match objects using flat name * simple access: refresh master domain info * NSS: add support for subdomain_homedir * krb5: hint to increase krb5_auth_timeout * utils: handling NULL params in sss_parse_name * Revert "NSS: add support for subdomain_homedir" * AD: support for subdomain_homedir * MAN: update of subdomain_homedir usage * CONFDB: fail if there are domains with same name * MONITOR: Incorrect permissions on sssd.conf * MAN: new general options section * MAN: Option name typo in sssd-krb5 * refactor calls of sss_parse_name * KRB5: log message - wrong permissions on ccache dir * MAN: minimal value expected for ldap_idmap_range_size * PAC: fix clang warning * failover: Shorter retry time for failed SRV * SDAP: augmented logging for group saving * KRB: do not check ccache directory for GID * KRB5: Go offline in case of generic error * Monitor: fix message wrong perm. mode on config file * util: Fix 'wrong mode' debug message * AD Provider: bug-fix uninitialized variable * AD Provider: bugfix use-after-free * TEST: Remove unused variable * TEST: fix warning in sbus_codegen_tests * TEST: unused variable * TEST: simple_access & sysdb tests - cleanup * LDAP: fix - find primary group by gid * MAN: Detailed ldap_group_nesting_level option * SDAP: Make nesting_level = 0 to ignore nested groups * SDAP: Add option to disable use of Token-Groups * MAN: hint nested groups by simple access provider * IPA: Rename label in users_get_send/groups_get_send * SYSDB: utility call sysdb_attrs_add_lower_case_string * TESTS: sss_ssh - textual public key format * AD: cleanup redundant #define statements * NSS: sysdb_getnetgr check return value first * NSS: sysdb_getnetgr refactor * NSS: fix memory leak in sysdb_getnetgr * NSS: minor code style improvements * TESTS: sysdb_search_return_ENOENT - check mem leaks * SYSDB: sysdb_search_entry fix memory leak * SYSDB: sysdb_search_custom fix memory leak * SYSDB: sss_ldb_search - wrapper around ldb_search * TESTS: add tests for sss_ldb_search * SYSDB: sysdb_getnetgr returns ENOENT * TESTS: sysdb_getnetgr - return ENOENT * NSS: lookup_netgr_step don't access result on ENOENT * sudo: return after tevent_req_error * SDAP: return after tevent_req_error * LDAP: group_split_members returns incorrectly ENOMEM Pete Fritchman (1): * PAM: add ignore_unknown_user option Simo Sorce (9): * util: Use systemd-login to check user sessions * krb5: Be more lenient on failures for old ccache * util: Allways fall back to old find_uid method * krb5: Remove ability to create public directories * Signals: Remove unused functions * Signals: Remove empty sig_hup * Signals: Refactor termination of processes * util: Change file check fns to use a mode mask * confdb: Change file checks for config file Stef Walter (19): * Update .gitignore for 'make check' built files * util: Fix const cast failures when building with -Werror * util: A safe printf for user provided format strings * NSS: Don't use printf(3) on user provided strings. * sbus: Add meta data structures and code generator * sbus: Add sbus_vtable and update codegen to support it * nss: Stop using one DBus interface with totally different methods * sbus: Rework sbus to use interface metadata and vtables * sbus: Generate constants from interface definitions * sbus: Use constants to make dbus calls * providers: Fix types passed to dbus varargs functions * sbus: Add struct sbus_request to represent a DBus invocation * sbus: Refactor how we export DBus interfaces * sbus: Make sbus_new_server() work for non-priveleged processes * sbus_tests: Add some testing of dispatch and handler code * sbus: Add the sbus_request_parse_or_finish() method * sbus: Add type-safe DBus method handlers and finish functions * sbus_codegen_tests: Add test case type-safe handler args * SBUS: Start implementing property access Stephen Gallagher (9): * SYSDB: Fix incorrect DEBUG message * MAN: Clarify debug level documentation * MAN: Reflow debug_levels.xml * BUILD: Update bashrc macros * DEBUG: Allow debug_fn to process FILE and LINE * DEBUG: Enable sending structured debug logs to journald * BUILD: Build with journald support by default on Fedora * BUILD: Simplify enabling journald on installed systems * AD Provider: Fix crash looking up forest on Samba 4 Sumit Bose (68): * Do not set HAVE_SYSTEMD_LOGIN if libsystemd-login is not available * sdap_domain_add: remove too strict consistency check * krb5: save canonical upn to sysdb * krb5: do not expand enterprise principals is offline * IPA: store forest name for forest member domains * ipa_server_mode: write capaths to krb5 include file * Do not return DP_ERR_FATAL in case of success * AD: properly intitialize GC from ad_server option * LDAP: handle SID requests if noexist_delete is set * Spec file changes for cifs-utils plugin * IPA server mode: properly initialize ext_groups * idmap: add internal function to free a domain struct * idmap: fix a memory leak if a collision is detected * idmap: allow ranges with external mapping to overlap * sdap_idmap: add sdap_idmap_get_configured_external_range() * sdap_idmap: properly handle ranges for external mappings * Add unconditional online callbacks * IPA: add callback to reset subdomain timeouts * sdap_get_generic_ext_send: check if we a re still connected * find_subdomain_by_sid: skip domains with missing domain_id * idmap: add sss_idmap_domain_by_name_has_algorithmic_mapping() * sdap_idmap_domain_has_algorithmic_mapping: add domain name argument * IPA: add trusted domains with missing idrange * ad_subdom_store: check ID mapping of the domain not of the parent * be_spy_create: free be_req and not the long living data * Enhance/add unit tests for find_subdomain_by_sid/name * Replace prog_DEPENDENCIES with EXTRA_prog_DEPENDENCIES * Add sss_packet_get_status() * sss_names_init: allow empty domain name * nss: save global name configuration to the nss context * Add sss_tc_fqname2() * Add utility to handle Well-Known SIDs * nss-srv-tests: check packet status * nss: check for Well-Known SIDs in SID based requests * Update CIFS plugin for Well-Known SID support * rfc2307bis_nested_groups_send: reuse search base * AD: use LDAP for group lookups * sss_cache: initialize names member of sss_domain_info * sss_cache: fix case-sensitivity issue * Add sysdb_attrs_add_lc_name_alias * Use sysdb_attrs_add_lc_name_alias to add case-insensitive alias * Use lower-case name for case-insensitive searches * Add new option ldap_group_type * Add sysdb_attrs_get_int32_t * AD: filter domain local groups for trusted/sub domains * AD: cross-domain membership fix * IPA: fix for recent AD group membership changes * AD SRV: use right domain name for CLDAP ping * IDMAP: add sss_idmap_check_collision(_ex) * IPA: refactor idmap code and add test * IPA: check ranges for collisions before saving them * libsss_idmap: bump version-info * config API: add missing subdomain target to AD provider test * SUDO: AD provider * config API: read only specific files from schemaplugindir * config API: prepend source dir search path for tests * ipa-server-mode: use lower-case user name for home dir * IPA: Use GC for AD initgroup requests * IPA/KRB5: handle KRB5_PROG_ETYPE_NOSUPP during IPA password migration * krb5_child: remove unused option lifetime_str from k5c_setup_fast() * krb5-child: extract lifetime settings into set_lifetime_options() * krb5_client: rename krb5_set_canonicalize() to set_canonicalize_option() * krb5-child: add revert_changepw_options() * Make LDAP extra attributes available to IPA and AD * contrib: add BuildRequires? libsmbclient-devel to spec file * Fix return value of attr_name_val_split() and attr_op() * sysdb: make canonicalUserPrincipalName case-insensitive * sysdb: add sysdb_search_user_by_upn() with tests Yassir Elley (9): * ad_access_filter man page typo * Implemented LDAP component of GPO-based access control * AD-GPO: Remove dependency on libsamba-security * AD-GPO: add libsmbclient to makefiles * AD-GPO: Fix some failure modes in ad_gpo.c * TEST: Add ad_gpo unit tests * AD-GPO: Add gpo-smb implementation in gpo_child process * Use ldap_url_parse to extract hostname from ldap uri * AD-GPO: Add support for gpo permissive mode

1 0

SSSD & SSH on Ubuntu 14.04 - login failure
by Johannes Ramm-Ericson 06 Jul '14

06 Jul '14

Hi, Apologies for any naively stated questions but I am having trouble getting SSSD, Active Directory and SSH to interact as I expect on an Ubuntu 14.04 server. To be quite honest; I am not even certain that SSSD is the problem anymore since I seem to have successfully authenticated, it's just that my SSH session is interrupted with : johannes@laplnxjohannes:~$ ssh johannes@bifrost-test Password: Write failed: Broken pipe Extract from /var/log/auth.log ------------------------------------------ Jul 3 14:49:58 bifrost-test sshd[10281]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=lichen user=johannes Jul 3 14:49:58 bifrost-test sshd[10279]: Accepted keyboard-interactive/pam for johannes from 192.168.120.12 port 35886 ssh2 Jul 3 14:49:58 bifrost-test sshd[10279]: fatal: PAM: pam_setcred(): Failure setting user credentials My /etc/nsswitch.conf -------------------------------- passwd: files sss group: files sss shadow: files sss hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis sudoers: files /etc/pam.d/common-session: ------------------------------------------ session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # The pam_umask module will set the umask according to the system default in # /etc/login.defs and user settings, solving the problem of different # umask settings with different shells, display managers, remote sessions etc. # See "man pam_umask". session optional pam_umask.so # and here are more per-package modules (the "Additional" block) session required pam_unix.so session optional pam_sss.so # end of pam-auth-update config root@bifrost-test:/var/log/sssd# apt-cache policy sssd sssd: Installed: 1.11.5-1ubuntu3 I have done my share of googling and only ended up with some very old - seemingly, irrelevant to my problem - page hits. So, I've turned to this mailing list in hope of finding someone who may have encountered similar issues. Any ideas or suggestions? Thanks and Best Regards, Johannes

3 2

Get error "Incorrect Password" when su to a ldap user with password prompt
by XuQing Tan 01 Jul '14

01 Jul '14

Hi folks i setup sssd 1.9.2 on centos 6 x64 i can get the user info via 'id <user>' i can su to that user as root (no password prompt since i'm root) [root@nick-ldap ~]# su - nick -sh-4.1$ exit logout but i can't su to this user as non-root (with password prompt but get incorrect password error) [root@nick-ldap ~]# su - demo [demo@nick-ldap ~]$ su - nick Password: su: incorrect password [demo@nick-ldap ~]$ do you have anyideas why i got this? thanks Thanks & Best Regards! /// (. .) --------ooO--(_)--Ooo-------- | Nick Tan | ------------------------------------

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users July 2014