I'm using sssd 1.13.3 and try to configure sssd for nss and pam both against our openldap server. Nss seems to work but pam doesn't.

# getent passwd timap timap:*:41848:400:Test Imap:/users/org1/timap:/usr/local/bin/bash

but login of the timap user fails:

syslog output: login[2315]: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=timap login[2315]: pam_sss(login:auth): received for user timap: 7 (Authentication failure) login[2315]: FAILED LOGIN 1 FROM tty1 FOR timap, Authentication failure

Maybe we have an unusal ldap server setup. There is a privileged DN cn=roadmin,ou=people,ou=admin,dc=myorg,dc=de to access all posixAccount objects.

a user Account has this attributes:

# ldapsearch -x -w secret -D "cn=roadmin,ou=people,ou=admin,dc=myorg,dc=de" '(&(uid=timap)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))' # extended LDIF # # LDAPv3 # base <ou=people,dc=myorg,dc=de> (default) with scope subtree # filter: (&(uid=timap)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0)))) # requesting: ALL #

# timap, people, myorg.de dn: uid=timap,ou=people,dc=myorg,dc=de userPassword:: e0NSWVBUfSQ2JDV5N1B5RC84N3pRY2VmZlgkMk1LQjAxc1pFNzBzYXFsOUhZNWo 3WFhJSVZXOWMuTHdOZEZpMzV5UVpzYlN0ZGpLVDVhdVdKeWRlcVdBSDMySmhwanZMNGJkZnVhYXMy SVFxVG41Yi8= cn: timap gecos: Test Imap gidNumber: 400 homeDirectory: /users/org1/timap loginShell: /usr/local/bin/bash objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount uid: timap uidNumber: 41848

My configuration is

--------/etc/sssd/sssd.conf------------------- [sssd] config_file_version = 2 services = nss,pam domains = LDAP

[nss] filter_groups = root filter_users = root

[pam] pam_verbosity = 3

[domain/LDAP] debug_level = 0xFFF0 ldap_uri = ldaps://ldapserver.myorg.de ldap_search_base = dc=myorg,dc=de ldap_schema = rfc2307 id_provider = ldap ldap_id_use_start_tls = True enumerate = False cache_credentials = True chpass_provider = ldap auth_provider = ldap ldap_tls_cacertdir = /var/ldap ldap_tls_cacert = /var/ldap/certdb.pem ldap_tls_reqcert = demand ldap_default_bind_dn = cn=roadmin,ou=people,ou=admin,dc=myorg,dc=de ldap_default_authtok_type = password ldap_default_authtok = secret ---------------------------------------

--------/etc/nsswitch.conf------------- passwd: files sss group: files sss shadow: files sss

hosts: files dns ---------------------------------------

Excerpt of sssd_LDAP.log: [sssd[be[LDAP]]] [simple_bind_done] (0x0400): Bind result: Success(0), no errmsg set [sssd[be[LDAP]]] [simple_bind_send] (0x0100): Executing simple bind as: cn=roadmin,ou=people,ou=admin,dc=myorg,dc=de [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'ldapserver.myorg.de' as 'working' [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request for [0x1001][FAST BE_REQ_USER][1][name=timap] [sssd[be[LDAP]]] [be_req_set_domain] (0x0400): Changing request domain from [LDAP] to [LDAP] [sssd[be[LDAP]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection [sssd[be[LDAP]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [dc=myorg,dc=de] [sssd[be[LDAP]]] [sdap_print_server] (0x2000): Searching xxx.xxx.xxx.xxx [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=timap)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][dc=myorg,dc=de]. [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid] [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword] [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [homeDirectory] [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPrincipalName] [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn] [sssd[be[LDAP]]] [sdap_parse_entry] (0x1000): OriginalDN: [uid=timap,ou=people,dc=myorg,dc=de]. [sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [userPassword] [sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [cn] [sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [gecos] [sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [gidNumber] [sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [homeDirectory] [sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [loginShell] [sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass] [sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [uid] [sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [uidNumber] [sssd[be[LDAP]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimestamp] [sssd[be[LDAP]]] [sdap_save_user] (0x2000): Adding originalDN [uid=timap,ou=people,dc=myorg,dc=de] to attributes of [timap]. [sssd[be[LDAP]]] [sdap_save_user] (0x0400): Storing info for user timap

So far this looks good. nss is working, but the pam request not! Pam is using an additional simple_bind as uid=timap,ou=people,dc=myorg,dc=de instead of directly authenticating against the hash of the timap userPassword attribute we already got from the ldap request above

[sssd[be[LDAP]]] [be_req_set_domain] (0x0400): Changing request domain from [LDAP] to [LDAP] [sssd[be[LDAP]]] [be_pam_handler] (0x0100): Got request with the following data [sssd[be[LDAP]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE [sssd[be[LDAP]]] [pam_print_data] (0x0100): domain: LDAP [sssd[be[LDAP]]] [pam_print_data] (0x0100): user: timap [sssd[be[LDAP]]] [pam_print_data] (0x0100): service: login [sssd[be[LDAP]]] [pam_print_data] (0x0100): tty: tty1 [sssd[be[LDAP]]] [pam_print_data] (0x0100): ruser: [sssd[be[LDAP]]] [pam_print_data] (0x0100): rhost: [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 1 [sssd[be[LDAP]]] [pam_print_data] (0x0100): newauthtok type: 0 [sssd[be[LDAP]]] [pam_print_data] (0x0100): priv: 1 [sssd[be[LDAP]]] [pam_print_data] (0x0100): cli_pid: 1863 [sssd[be[LDAP]]] [pam_print_data] (0x0100): logon name: not set [sssd[be[LDAP]]] [simple_bind_send] (0x0100): Executing simple bind as: uid=timap,ou=people,dc=myorg,dc=de [sssd[be[LDAP]]] [simple_bind_send] (0x2000): ldap simple bind sent, msgid = 1 [sssd[be[LDAP]]] [simple_bind_done] (0x0400): Bind result: Invalid credentials(49), no errmsg set

Does anyone have an idea howto configure sssd to authenticate against hash in the userPassword attribute of the timap account

The complete log is attached

Bing