<sssd-users-bounces@lists.fedorahosted.org>
wrote on 05/09/2013 08:00:02 AM:


> From: <sssd-users-request@lists.fedorahosted.org>
> To: <sssd-users@lists.fedorahosted.org>,

> Date: 05/09/2013 08:01 AM
> Subject: sssd-users Digest, Vol 13, Issue 11
> Sent by: <sssd-users-bounces@lists.fedorahosted.org>
> 

> Send sssd-users mailing list submissions to

>    sssd-users@lists.fedorahosted.org

> 

> To subscribe or unsubscribe via the World Wide Web, visit

>    
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> or, via email, send a message with subject or body 'help' to

>    sssd-users-request@lists.fedorahosted.org

> 

> You can reach the person managing the list at

>    sssd-users-owner@lists.fedorahosted.org

> 

> When replying, please edit your Subject line so it is more specific

> than "Re: Contents of sssd-users digest..."

> 

> 

> Today's Topics:

> 

>    1. Re:  Ldap Help (Dmitri Pal)

>    2. Re:  RHEL5, sssd and the Global Catalog (Jakub
Hrozek)

>    3. Re:  Ldap Help (Jakub Hrozek)

> 

> 

> ----------------------------------------------------------------------

> 

> Message: 1

> Date: Wed, 08 May 2013 13:29:24 -0400

> From: Dmitri Pal <dpal@redhat.com>

> To: sssd-users@lists.fedorahosted.org

> Subject: Re: [SSSD-users] Ldap Help

> Message-ID: <518A8B74.6060104@redhat.com>

> Content-Type: text/plain; charset=UTF-8

> 

> On 05/08/2013 12:57 PM, Brandon Foster wrote:

> > On Wed, May 8, 2013 at 9:52 AM, Sumit Bose <sbose@redhat.com>
wrote:

> >> On Wed, May 08, 2013 at 09:43:48AM -0700, Brandon Foster
wrote:

> >>> On Wed, May 8, 2013 at 9:26 AM, Wojtak, Greg (Superfly)

> >>> <GregWojtak@quickenloans.com> wrote:

> >>>> I think your syntax is a little off.  Try

> >>>>

> >>>> ldapsearch -x -LLL '(&(uid=test.user)(objectClass=posixAccount))'
uid

> >>>> uidnumber homedirectory gidnumber loginshell

> >>>>

> >>>> You should have those 5 values returned.

> >>>>

> >>>> --

> >>>> Greg Wojtak

> >>>> Senior Unix Systems Engineer

> >>>> Office: (313) 373-4306

> >>>> Mobile: (734) 718-8472

> >>>>

> >>>>

> >>>>

> >>>>

> >>>>

> >>>>

> >>>> On 5/8/13 11:52 AM, "Brandon Foster" <brandon.foster@liferay.com>
wrote:

> >>>>

> >>>>> On Wed, May 8, 2013 at 5:05 AM, Sumit Bose <sbose@redhat.com>
wrote:

> >>>>>> On Tue, May 07, 2013 at 11:39:45AM -0700,
Brandon Foster wrote:

> >>>>>>> Hey all,

> >>>>>>> Im back with another ldap question. this
time I rebuilt sssd and

> >>>>>>> followed this guide:

> >>>>>>>

> >>>>>>> 
http://blog.f1linux.com/2013/04/21/howto-part-3-ldap-client-


> configuratio

> >>>>>>> n-and-troubleshooting/

> >>>>>>> for setting up ldap authentication on
my centos 6.4 system.

> >>>>>>>

> >>>>>>> my firewall is off and selinux is disabled.

> >>>>>>>

> >>>>>>> when i do an ldapsearch -x "cn=test.user"
it returns all the correct

> >>>>>>> information, but doing id test.user returns
no user.

> >>>>>> As you can see from the logs SSSD is using

> >>>>>> "(&(uid=test.user)(objectclass=posixAccount))"
as search 

> filter, can you

> >>>>>> check if ldapsearch with this filter finds
the entry as well?

> >>>>>> Additionally can you check that the user
object is located below the

> >>>>>> search base you have given in sssd.conf?

> >>>>>>

> >>>>>> HTH

> >>>>>>

> >>>>>> bye,

> >>>>>> Sumit

> >>>>>>> I've attached the log files and all of
the relevant files and maybe

> >>>>>>> some non relevant ones as well.

> >>>>>>>

> >>>>>>> it appears as tho it is searching for
the user but is simply not

> >>>>>>> finding anything. Is there an option
to search for cn=test.user? and

> >>>>>>> not by uid?

> >>>>>>>

> >>>>>>> any help will be much appreciated.

> >>>>>>

> >>>>>>

> >>>>>>

> >>>>>>

> >>>>>>

> >>>>>>

> >>>>>>

> >>>>>>

> >>>>>>> _______________________________________________

> >>>>>>> sssd-users mailing list

> >>>>>>> sssd-users@lists.fedorahosted.org

> >>>>>>> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> >>>>>> _______________________________________________

> >>>>>> sssd-users mailing list

> >>>>>> sssd-users@lists.fedorahosted.org

> >>>>>> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> >>>>> thanks for the reply,

> >>>>> the user is definitely under the groups in sssd.conf.

> >>>>>

> >>>>> ldapsearch with objectclass=posixAccount seems
to be part of the

> >>>>> issue. Also it is searching for uid rather than
the cn of the user.

> >>>>>

> >>>>> if I do ldapsearch -x "uid=<UID of test.user>
it works fine

> >>>>>

> >>>>> if i do ldapsearch -x "uid=<UID of test.user>"

> >>>>> "objectclass=posixAccount" it does
not.

> >>>>>

> >>>>> ldapsearch -x "uid=test.user" returns
all of the users in the search.

> >>>>>

> >>>>> and finally ldapsearch -x "uid=test.user"
"objectclass=posixAccount"

> >>>>> returns no users.

> >>>>>

> >>>>> so how do I tell my sssd to not use this filter?
and to use cninstead of

> >>>>> uid?

> >>>>> _______________________________________________

> >>>>> sssd-users mailing list

> >>>>> sssd-users@lists.fedorahosted.org

> >>>>> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> >>>> _______________________________________________

> >>>> sssd-users mailing list

> >>>> sssd-users@lists.fedorahosted.org

> >>>> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> >>>

> >>> sorry, not to familiar with the ldapsearch commands.

> >>>

> >>> anyways, test.user is not of objectclass posixAccoount
so with that

> >>> filter nothing comes back, if I change it to cn= and
objectclass=<an

> >>> objectlcass test.user is a part of> then it just returns
the DN of the

> >>> user.

> >>>

> >>> ldap_user_name = cn

> >>> ldap_user_object_class =

> >>>

> >>> attributes in sssd.conf seem to be altering these values
for me when i

> >>> search for the id of test.user.

> >>>

> >>> but it cant seem to find uiduidnumber homedirectory gidnumber
or

> >>> loginshell attributes for my users.

> >> it looks that you are using a custom LDPA schema. You can
map the

> >> default attributes for home directory etc to other values
with

> >>

> >> ldap_user_home_directory

> >> ldap_user_uid_number

> >> ldap_user_gid_number

> >> ldap_user_shell

> >>

> >> respectively, see man sssd-ldap for more details, e.g. how
to map group

> >> attributes.

> >>

> >> HTH

> >>

> >> bye,

> >> Sumit

> >>> _______________________________________________

> >>> sssd-users mailing list

> >>> sssd-users@lists.fedorahosted.org

> >>> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> >> _______________________________________________

> >> sssd-users mailing list

> >> sssd-users@lists.fedorahosted.org

> >> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> >

> > yeah, a large part of my problem is that I did not set up this
ldap.

> >

> > is there a way I can assign say a gid or home directory rather
than

> > getting it from ldap?

> 

> gid - no

> but with home directory you can have a local override. See man pages
for

> more details.

> 

> > _______________________________________________

> > sssd-users mailing list

> > sssd-users@lists.fedorahosted.org

> > 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> 

> 

> -- 

> Thank you,

> Dmitri Pal

> 

> Sr. Engineering Manager for IdM portfolio

> Red Hat Inc.

> 

> 

> -------------------------------

> Looking to carve out IT costs?

> 
www.redhat.com/carveoutcosts/


> 

> 

> 

> 

> 

> ------------------------------

> 

> Message: 2

> Date: Thu, 9 May 2013 11:32:06 +0200

> From: Jakub Hrozek <jhrozek@redhat.com>

> To: sssd-users@lists.fedorahosted.org

> Subject: Re: [SSSD-users] RHEL5, sssd and the Global Catalog

> Message-ID: <20130509093206.GG3429@hendrix.brq.redhat.com>

> Content-Type: text/plain; charset=iso-8859-1

> 

> On Tue, May 07, 2013 at 02:35:00PM -0400, Will_Darton@navyfederal.org
wrote:

> >    Have configured a couple of hundred hosts to use
sssd w/ LDAP to connect

> >    to the Global Catalog of a Windows 2008 Domain for
identify and

> >    authentication.  All of my RHEL6 servers appear
to be fine, however

> >    certain accounts on certain systems in my RHEL5
environments are having

> >    issues.

> > 

> 

> I'm not aware of differences between RHEL5 and RHEL6 codebase with

> respect to LDAP searches that might cause this problem.

> 

> >    upon su - <user> I get the following

> >    [root@slvdcls15 ~]# su - wasadmin

> >    id: cannot find name for user ID 1209

> >    id: cannot find name for user ID 1209

> > 

> >    issuing a crontab -l also seems problematic...

> > 

> >    $ crontab -l

> >    crontab: your UID isn't in the passwd file.

> >    bailing out.

> > 

> >    However querying sssd for info seems ok

> >    $ id

> >    uid=1209(wasadmin) gid=1209(was) groups=1209(was)

> > 

> >    $ getent passwd wasadmin

> >    wasadmin:*:1209:1209:WebSphere admin:/home/wasadmin:/bin/ksh

> > 

> >    Appreciate any advise assistance in troubleshooting

> > 

> >    Package info

> >    sssd-1.5.1-58.el5

> > 

> >    Releaee

> >    2.6.18-348.3.1.el5

> > 

> >    /etc/sssd/sssd.conf

> >    [domain/sample]

> >    description = Domain

> >    debug_level = 9

> 

> I see you already raised debugging in the domain section, can you
paste

> or attach the domain logs? Feel free to sanitize them first to remove

> any sensitive information..

> 

> Can you also put the debug_level stanza to the [nss] section to gather

> logs from the NSS responder?

> 

> >    enumerate = false

> >    id_provider = ldap

> >    auth_provider = ldap

> >    chpass_provider = ldap

> >    access_provider = ldap

> > 

> >    ldap_uri = ldaps://<url>:3269

> >    ldap_tls_cacertdir = /etc/openldap/cacerts

> >    ldap_tls_cacert = /etc/openldap/cacerts/certificate.cer

> >    ldap_search_base = dc=domain,dc=net

> >    ldap_default_bind_dn = cn=aixldap,OU=service

> >    accounts,DC=sub,DC=domain,DC=net

> >    ldap_default_authtok_type = password

> >    ldap_default_authtok = <password>

> >    ldap_access_filter =

> >    (|(department=*unixadmin*)(department=*tools*)

> (department=*was*)(department=*oracle*))

> >    ldap_pwd_policy = none

> >    ldap_user_name = cn

> >    ldap_user_object_class = user

> >    ldap_group_object_class = group

> >    ldap_schema = rfc2307bis

> >    ldap_user_home_directory = unixHomeDirectory

> >    ldap_tls_reqcert = never

> >    ldap_referrals = false

> >    case_sensitive = false

> > 

> >    [sssd]

> > 

> >    services = nss, pam

> >    config_file_version = 2

> >    domains = nfcu

> > 

> >    [nss]

> > 

> >    [pam]

> >    offline_credentials_expiration = 5

> > 

> >    [sudo]

> > 

> >    [autofs]

> > 

> >    [ssh]

> > 

> >    /* -----------------------------

> >    Will Darton

> >    I.T. Operations

> >    Information Services

> >    Navy Federal Credit Union

> >    wk 703.255.8639

> >    cell: 703.232.2344

> >    will_darton@navyfederal.org

> >    */

> 

> > _______________________________________________

> > sssd-users mailing list

> > sssd-users@lists.fedorahosted.org

> > 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> 

> 

> 

> ------------------------------

> 

> Message: 3

> Date: Thu, 9 May 2013 12:32:10 +0200

> From: Jakub Hrozek <jhrozek@redhat.com>

> To: sssd-users@lists.fedorahosted.org

> Subject: Re: [SSSD-users] Ldap Help

> Message-ID: <20130509103210.GH3429@hendrix.brq.redhat.com>

> Content-Type: text/plain; charset=us-ascii

> 

> On Wed, May 08, 2013 at 01:29:24PM -0400, Dmitri Pal wrote:

> > On 05/08/2013 12:57 PM, Brandon Foster wrote:

> > > On Wed, May 8, 2013 at 9:52 AM, Sumit Bose <sbose@redhat.com>
wrote:

> > >> On Wed, May 08, 2013 at 09:43:48AM -0700, Brandon Foster
wrote:

> > >>> On Wed, May 8, 2013 at 9:26 AM, Wojtak, Greg (Superfly)

> > >>> <GregWojtak@quickenloans.com> wrote:

> > >>>> I think your syntax is a little off.  Try

> > >>>>

> > >>>> ldapsearch -x -LLL '(&(uid=test.user)(objectClass=posixAccount))'
uid

> > >>>> uidnumber homedirectory gidnumber loginshell

> > >>>>

> > >>>> You should have those 5 values returned.

> > >>>>

> > >>>> --

> > >>>> Greg Wojtak

> > >>>> Senior Unix Systems Engineer

> > >>>> Office: (313) 373-4306

> > >>>> Mobile: (734) 718-8472

> > >>>>

> > >>>>

> > >>>>

> > >>>>

> > >>>>

> > >>>>

> > >>>> On 5/8/13 11:52 AM, "Brandon Foster"


> <brandon.foster@liferay.com> wrote:

> > >>>>

> > >>>>> On Wed, May 8, 2013 at 5:05 AM, Sumit Bose
<sbose@redhat.com> wrote:

> > >>>>>> On Tue, May 07, 2013 at 11:39:45AM -0700,
Brandon Foster wrote:

> > >>>>>>> Hey all,

> > >>>>>>> Im back with another ldap question.
this time I rebuilt sssd and

> > >>>>>>> followed this guide:

> > >>>>>>>

> > >>>>>>> 
http://blog.f1linux.com/2013/04/21/howto-part-3-ldap-


> client-configuratio

> > >>>>>>> n-and-troubleshooting/

> > >>>>>>> for setting up ldap authentication
on my centos 6.4 system.

> > >>>>>>>

> > >>>>>>> my firewall is off and selinux is
disabled.

> > >>>>>>>

> > >>>>>>> when i do an ldapsearch -x "cn=test.user"
it returns all the correct

> > >>>>>>> information, but doing id test.user
returns no user.

> > >>>>>> As you can see from the logs SSSD is
using

> > >>>>>> "(&(uid=test.user)(objectclass=posixAccount))"
as search 

> filter, can you

> > >>>>>> check if ldapsearch with this filter
finds the entry as well?

> > >>>>>> Additionally can you check that the
user object is located below the

> > >>>>>> search base you have given in sssd.conf?

> > >>>>>>

> > >>>>>> HTH

> > >>>>>>

> > >>>>>> bye,

> > >>>>>> Sumit

> > >>>>>>> I've attached the log files and
all of the relevant files and maybe

> > >>>>>>> some non relevant ones as well.

> > >>>>>>>

> > >>>>>>> it appears as tho it is searching
for the user but is simply not

> > >>>>>>> finding anything. Is there an option
to search for cn=test.user? and

> > >>>>>>> not by uid?

> > >>>>>>>

> > >>>>>>> any help will be much appreciated.

> > >>>>>>

> > >>>>>>

> > >>>>>>

> > >>>>>>

> > >>>>>>

> > >>>>>>

> > >>>>>>

> > >>>>>>

> > >>>>>>> _______________________________________________

> > >>>>>>> sssd-users mailing list

> > >>>>>>> sssd-users@lists.fedorahosted.org

> > >>>>>>> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> > >>>>>> _______________________________________________

> > >>>>>> sssd-users mailing list

> > >>>>>> sssd-users@lists.fedorahosted.org

> > >>>>>> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> > >>>>> thanks for the reply,

> > >>>>> the user is definitely under the groups
in sssd.conf.

> > >>>>>

> > >>>>> ldapsearch with objectclass=posixAccount
seems to be part of the

> > >>>>> issue. Also it is searching for uid rather
than the cn of the user.

> > >>>>>

> > >>>>> if I do ldapsearch -x "uid=<UID
of test.user> it works fine

> > >>>>>

> > >>>>> if i do ldapsearch -x "uid=<UID
of test.user>"

> > >>>>> "objectclass=posixAccount" it
does not.

> > >>>>>

> > >>>>> ldapsearch -x "uid=test.user"
returns all of the users in the search.

> > >>>>>

> > >>>>> and finally ldapsearch -x "uid=test.user"
"objectclass=posixAccount"

> > >>>>> returns no users.

> > >>>>>

> > >>>>> so how do I tell my sssd to not use this
filter? and to use 

> cn instead of

> > >>>>> uid?

> > >>>>> _______________________________________________

> > >>>>> sssd-users mailing list

> > >>>>> sssd-users@lists.fedorahosted.org

> > >>>>> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> > >>>> _______________________________________________

> > >>>> sssd-users mailing list

> > >>>> sssd-users@lists.fedorahosted.org

> > >>>> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> > >>>

> > >>> sorry, not to familiar with the ldapsearch commands.

> > >>>

> > >>> anyways, test.user is not of objectclass posixAccoount
so with that

> > >>> filter nothing comes back, if I change it to cn=
and objectclass=<an

> > >>> objectlcass test.user is a part of> then it just
returns the DN of the

> > >>> user.

> > >>>

> > >>> ldap_user_name = cn

> > >>> ldap_user_object_class =

> > >>>

> > >>> attributes in sssd.conf seem to be altering these
values for me when i

> > >>> search for the id of test.user.

> > >>>

> > >>> but it cant seem to find uiduidnumber homedirectory
gidnumber or

> > >>> loginshell attributes for my users.

> > >> it looks that you are using a custom LDPA schema. You
can map the

> > >> default attributes for home directory etc to other values
with

> > >>

> > >> ldap_user_home_directory

> > >> ldap_user_uid_number

> > >> ldap_user_gid_number

> > >> ldap_user_shell

> > >>

> > >> respectively, see man sssd-ldap for more details, e.g.
how to map group

> > >> attributes.

> > >>

> > >> HTH

> > >>

> > >> bye,

> > >> Sumit

> > >>> _______________________________________________

> > >>> sssd-users mailing list

> > >>> sssd-users@lists.fedorahosted.org

> > >>> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> > >> _______________________________________________

> > >> sssd-users mailing list

> > >> sssd-users@lists.fedorahosted.org

> > >> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> > >

> > > yeah, a large part of my problem is that I did not set up
this ldap.

> > >

> > > is there a way I can assign say a gid or home directory
rather than

> > > getting it from ldap?

> > 

> > gid - no

> 

> In general you can't override the group list the user is a member
of but

> you can override the primary gid. See the "override_gid"
option in man

> sssd.conf

> 

> > but with home directory you can have a local override. See man
pages for

> > more details.

> 

> 

> ------------------------------

> 

> _______________________________________________

> sssd-users mailing list

> sssd-users@lists.fedorahosted.org

> 
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


> 

> 

> End of sssd-users Digest, Vol 13, Issue 11

> ******************************************