sssd-users November 2017

sssd-users@lists.fedorahosted.org

22 participants
22 discussions

Change LDAP-Filter for SSSD
by Stefan Kania 17 Nov '17

17 Nov '17

Hello, I would like to change the search-filter for sssd because I created my own Group-Objectclass, but if I do a "getent group" I will not see my own group. My sssd.conf looks like this: ------------------ [sssd] config_file_version = 2 services = nss, pam domains = LDAP [domain/LDAP] ldap_schema=rfc2307 ldap_uri = ldap://ldapserver.example.net:389 ldap_search_base=dc=example,dc=net ldap_default_bind_dn=uid=sssd-user,ou=users,dc=example,dc=net ldap_default_authtok=geheim id_provider=ldap auth_provider=ldap chpass_provider = ldap ldap_chpass_uri = ldap://ldapmaster.example.net:389 cache_credentials = True enumerate = true ldap_tls_cacertdir = /etc/ssl/zertifikate/demoCA ldap_tls_cacert = /etc/ssl/zertifikate/demoCA/cacert.pem ------------------ Everytime I do a "getent group" I see the following lines inside the log: ------------------ Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=1 BIND dn="uid=sssd-user,ou=users,dc=example,dc=net" mech=SIMPLE ssf=0 Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=1 RESULT tag=97 err=0 text= Nov 02 13:10:47 ldapserver slapd[2007]: conn=1044 op=2 SRCH base="dc=example,dc=net" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*))" ------------------- Is it possible to change the Filter: (&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*)) If "yes" how can I do this? I read to many howtos but I could not find a solution. Thanks for your help Stefan --

4 6

case sensitive email
by Galen Johnson 16 Nov '17

16 Nov '17

?Hey, We've recently noticed that users logging in using emails are having issues when they use camel case but it works fine when all lower case. We haven't changed the configs so case_sensitive = preserving? has not changed. Could the behavior have changed with a recent update. We are running version 1.15.2 (sssd-1.15.2-50.el7_4.6.x86_64?). This did not used to be the behavior. Is there some other config that we now need to enable to allow the previous behavior? thanks =G=

3 7

sssd + password
by Günther J. Niederwimmer 16 Nov '17

16 Nov '17

Hello List, CentOS 7.4 sssd 1.15.2-50 I have a Problem with sssd and Pam for the Mailserver config? I like to rsync two dovecot server but this is not working the user can't authenticate himself ? In my old config I make this with freeipa -ldap direct, but I don't like a extra user for this. I read and read so much things about sssd, I mean this Problem "must" be working with sssd? I have installed a plugin for FreeIPA for the mailserver to have mailatrenateaddress for my user but I mean I can only correct read all this things with a ldap connect? When any have a better idee please tell me ? Thanks for a answer, -- mit freundlichen Grüssen / best regards, Günther J. Niederwimmer

2 1

I'm getting this message when i'm login ldap user
by Nagaraja Murugan 15 Nov '17

15 Nov '17

I'm getting this message when i'm login ldap user. given ERROR Then I got error in log file " [sssd[autofs]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error". Nov 14 12:50:28 inf25emp02.atcaya.com gdm[1064]: gdm_session_set_environment_variable: assertion 'value != NULL' failed Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session[3691]: gnome-session-binary[3691]: WARNING: Could not make bus activated clients aware of QT_IM_MO Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session[3691]: gnome-session-binary[3691]: WARNING: Could not make bus activated clients aware of XMODIFIE Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session-binary[3691]: WARNING: Could not make bus activated clients aware of QT_IM_MODULE=ibus environment Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session[3691]: gnome-session-binary[3691]: WARNING: Could not make bus activated clients aware of GNOME_DE Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session[3691]: gnome-session-binary[3691]: WARNING: Could not make bus activated clients aware of XDG_MENU Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session[3691]: gnome-session-binary[3691]: WARNING: Could not make bus activated clients aware of QT_QPA_P Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session-binary[3691]: WARNING: Could not make bus activated clients aware of XMODIFIERS=@im=ibus environme Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session-binary[3691]: WARNING: Could not make bus activated clients aware of GNOME_DESKTOP_SESSION_ID=this Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session-binary[3691]: WARNING: Could not make bus activated clients aware of XDG_MENU_PREFIX=gnome- enviro Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session-binary[3691]: WARNING: Could not make bus activated clients aware of QT_QPA_PLATFORMTHEME=qgnomepl Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session[3691]: gnome-session-binary[3691]: WARNING: Could not get session id for session. Check that login Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session-binary[3691]: WARNING: Could not get session id for session. Check that logind is properly install Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session-binary[3691]: WARNING: Lost name on bus: org.gnome.SessionManager Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session[3691]: gnome-session-binary[3691]: WARNING: Lost name on bus: org.gnome.SessionManager Nov 14 12:50:28 inf25emp02.atcaya.com gnome-session[3691]: Unable to init server: Could not connect: Connection refused Nov 14 12:50:28 inf25emp02.atcaya.com audit[3702]: ANOM_ABEND auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 Nov 14 12:50:28 inf25emp02.atcaya.com kernel: gnome-session-f[3702]: segfault at 0 ip 00007f289fa4c229 sp 00007fff9593ce00 error 4 in libgtk-3.so.0.22 Nov 14 12:50:28 inf25emp02.atcaya.com abrt-hook-ccpp[3703]: Process 3702 (gnome-session-failed) of user 42 killed by SIGSEGV - dumping core Nov 14 12:50:29 inf25emp02.atcaya.com gdm-launch-environment][3682]: pam_unix(gdm-launch-environment:session): session closed for user gdm Nov 14 12:50:29 inf25emp02.atcaya.com audit[3682]: USER_END pid=3682 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 Nov 14 12:50:29 inf25emp02.atcaya.com audit[3682]: CRED_DISP pid=3682 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 Nov 14 12:50:29 inf25emp02.atcaya.com abrt-server[3704]: Deleting problem directory ccpp-2017-11-14-12:50:28-3702 (dup of ccpp-2017-10-30-12:48:21-397 Nov 14 12:50:44 inf25emp02.atcaya.com audit[3721]: USER_AUTH pid=3721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 Nov 14 12:50:44 inf25emp02.atcaya.com audit[3721]: USER_ACCT pid=3721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 Nov 14 12:50:44 inf25emp02.atcaya.com audit[3721]: CRED_REFR pid=3721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 Nov 14 12:50:55 inf25emp02.atcaya.com audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=fpr Nov 14 12:58:00 inf25emp02.atcaya.com org.gnome.Shell.desktop[1698]: Window manager warning: last_user_time (12815171) is greater than comparison time Nov 14 12:58:00 inf25emp02.atcaya.com org.gnome.Shell.desktop[1698]: Window manager warning: 0x100001f (LinuxQuest) appears to be one of the offending Nov 14 13:01:01 inf25emp02.atcaya.com CROND[3822]: (root) CMD (run-parts /etc/cron.hourly) Nov 14 13:01:01 inf25emp02.atcaya.com run-parts[3825]: (/etc/cron.hourly) starting 0anacron Nov 14 13:01:01 inf25emp02.atcaya.com run-parts[3831]: (/etc/cron.hourly) finished 0anacron Nov 14 13:02:26 inf25emp02.atcaya.com cupsd[1894]: REQUEST localhost - - "POST / HTTP/1.1" 200 192 Renew-Subscription successful-ok Nov 14 13:03:40 inf25emp02.atcaya.com firefox[2826]: gtk_clipboard_set_with_data: assertion 'targets != NULL' failed Nov 14 13:06:55 inf25emp02.atcaya.com gnome-shell[1698]: JS LOG: The property brightness doesn't seem to be a normal object property of [0x5577bcbcbe1 Nov 14 13:06:55 inf25emp02.atcaya.com gnome-shell[1698]: JS LOG: The property vignette_sharpness doesn't seem to be a normal object property of [0x557 //

2 1

SSSD Virtual Test Suite
by Pavel Březina 14 Nov '17

14 Nov '17

Hello, It took me a lot longer than I expected but here it is at last. This is my set of scripts that use vagrant and Ansible to automatically provision virtual environment that I use to develop and test SSSD. To create this environment you only need to run one command: $ ./setup.sh and after a while you have several machines provisioned and ready. This machines include LDAP, IPA and AD servers with one machine dedicated to SSSD. This machine is already enrolled to those servers. To start building and/or testing SSSD with all available providers, you can just run: $ vagrant ssh client Additionally, it allows you to automatically source your set of scripts on each login and access IPA web-ui from your browser. I tried to make the provisioning as fast as possible but it still takes approximately one hour on my machine. So be patient. Any ideas and patches for improvements are welcomed. The source is available at: https://github.com/pbrezina/sssd-test-suite

2 3

net groups with IPA
by Charles Hedrick 13 Nov '17

13 Nov '17

We want to move our net groups from NIS to IPA. I’ve loaded the groups. They’re visible on a system that uses nslcd pointed at the IPA server. But the systems that use SSSD for authentication don’t show anything. The net groups all show as undefined. I’ve turned on debugging and looked at the LDAP logs. It does the right quotes and the log says it extracts the members. But they don’t show up. Any idea where to look?

6 19

Re: shortnames for 2 realms in Centos6
by Grigory Trenin 11 Nov '17

11 Nov '17

Hi Jakub, Is there a chance that SSSD is rebased to 1.15.3 in RHEL6/Centos6? Maybe in 6.10? I'm also missing this nice feature in Centos 6 - short names with trusted domains. Yes, I know that RHEL6 has entered production phase this year, but hope dies last... Kind regards, Grigory Trenin

2 1

Re: [Freeipa-interest] Announcing SSSD 1.16.0
by Jakub Hrozek 09 Nov '17

09 Nov '17

On Mon, Oct 23, 2017 at 08:46:08PM +0200, Michael Ströder wrote: > HI! > > Has anything changed with building the man pages? > > I'm asking because I now get formatting markup in the output of man (see > below). No, not that I'm aware of. You render the man pages locally, right, because the tarball only contains the XML sources? > > Ciao, Michael. > > SSSD-LDAP(5) > File Formats and Conventions > SSSD-LDAP(5) > > .SH "NAME" sssd-ldap - SSSD LDAP provider > > .SH "DESCRIPTION" > > .PP This manual page describes the configuration of LDAP domains > for sssd(8). Refer to the “FILE FORMAT” section of the sssd.conf(5) > manual page for detailed syntax information. > > .PP You can configure SSSD to use more than one LDAP domain. >

3 5

How to match multiple access filter for a uid
by Asif Iqbal 08 Nov '17

08 Nov '17

Hi I like to authenticate user based on uid if meets the following two requirements ldap_search_base = ou=People,dc=mnet,dc=qintra,dc=com ldap_access_order = filter ldap_access_filter = objectClass=mnetPerson and ldap_search_base = ou=ACL Groups,ou=Groups,dc=mnet,dc=qintra,dc=com ldap_access_filter = (&(cn=jumpstation)(uniquemember=<dn of uid>)) Looking for a suggestion how to achieve this. -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

2 3

sssd with OTP does not work in all cases.
by Asif Iqbal 02 Nov '17

02 Nov '17

With pam_securid.so I can on /etc/pam.d/sshd auth sufficient pam_securid.so and at ssh login, I just put PIN at Password: prompt and then I get Enter SMS Token: prompt and I can then put the tokencode and I can ssh into the server fine. If I do the same with pam_sss.so it keeps asking for Password: and never changes the prompt to Enter SMS Token: and ssh fails badly. At this second Password: prompt I tried with just tokencode (at 18:45:34 in log below) or PIN and tokencode (at 18:47:55). Neither let me in and failed eventually. I think it is because pam_sss -> proxy -> securid -> pam_securd is failing to handle PAM conversation? Is there a way to fix that to so pam_sss to behave the right way and let authenticate in two steps with PIN and then TokenCode on next step? Also without this PAM conversation, when the PIN expires it will not let you update it. With simple pam.d/sshd and auth sufficient pam_securid.so that works very well as well. I have sssd.conf setup like this auth_server = proxy proxy_target_pam = securid And in pam.d/securid file auth sufficient pam_securid.so Here are some log http://dpaste.com/2HD27XH.txt where I tried with PIN at first Password: prompt and then TokenCode at second Password: prompt at 18:45:34 and failed to login And I tried with PIN at first Password: prompt and then PIN and TokenCode at second Password: prompt at 18:47:55 and failed to login I tried with SElinux off and on and same result If I put PIN and TokenCode at the first Password: prompt, login works fine . I did not put any log for that here. Any suggestion how to fix pam_sss for OTP? Thanks! -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

2 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users November 2017