Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have OpenLDAP server:

@(#) $OpenLDAP: slapd 2.4.23 (Aug  8 2012 16:29:21)

In my configuration have group:

ldapsearch -x -b 'cn=groupname,ou=UnixShell,ou=Services,o=example,c=ru'
# extended LDIF
# LDAPv3
# base <cn=groupname,ou=UnixShell,ou=Services,o=example,c=ru> with scope subtree
# filter: (objectclass=*)
# requesting: ALL

# groupname, UnixShell, Services, example, ru
dn: cn=groupname,ou=UnixShell,ou=Services,o=example,c=ru
cn: groupname
objectClass: groupOfUniqueNames
objectClass: top
uniqueMember: cn=Name Second,ou=Sysadmins,ou=SoftwareDevelopment,ou=IT,ou=Accounts,o=example,c=ru

# search result
search: 2
result: 0 Success

And user

# ldapsearch -x -b 'cn=Name Second,ou=Sysadmins,ou=SoftwareDevelopment,ou=IT,ou=Accounts,o=example,c=ru'
# extended LDIF
# LDAPv3
# base <cn=Name Second,ou=Sysadmins,ou=SoftwareDevelopment,ou=IT,ou=Accounts,o=example,c=ru> with scope subtree
# filter: (objectclass=*)
# requesting: ALL

# Name Second, Sysadmins, SoftwareDevelopment, IT, Accounts, example, ru
dn: cn=Name Second,ou=Sysadmins,ou=SoftwareDevelopment,ou=IT,ou=Accounts,o=
homeDirectory: /home/user
loginShell: /bin/bash
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowLastChange: 15361
shadowMax: 99999
shadowMin: 0
shadowWarning: 7
uid: user
uidNumber: 7000
cn: Name Second
gidNumber: 702

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

A long time i used LDAP authentication on my client servers (CentOS 6.*), but in one time when upgraded to 6.4 branch, my configuration has broke. Because now system default using SSSD.

In pam_ldap was

pam_groupdn cn=groupname,ou=UnixShell,ou=Services,o=example,c=ru
pam_member_attribute uniquemember

But now in sssd.conf it filter does not work

access_provider = ldap
ldap_access_filter = memberOf=cn=groupname,ou=UnixShell,ou=Services,o=example,c=ru

What am I doing wrong? My records can't find when i login through ssh. Works locally "su - user".

Error in sssd log

(Thu Mar 28 12:44:43 2013) [sssd[be[default]]] [sdap_access_filter_get_access_done] (0x0100): User [user] was not found with the specified filter. Denying access.

I'm use it for settings:

authconfig --enablemkhomedir --updateall --enablesssd --enablesssdauth --enableldap --enableldapauth --disablenis --disablekrb5 --disablecachecreds --disablecache  --ldaploadcacert=$certurl"

CentOS release 6.4 (Final)

!!! Do not change anything manually, only system utils !!!

# cat /etc/sssd/sssd.conf 

ldap_uri = ldaps://ldap02.example.ru
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_id_use_start_tls = True
cache_credentials = False

ldap_search_base = o=example,c=ru
krb5_realm = EXAMPLE.COM
krb5_server = kerberos.example.com

id_provider = ldap
auth_provider = ldap
chpass_provider = ldap

access_provider = ldap
ldap_access_filter = uniqueMember=cn=grouname,ou=UnixShell,ou=Services,o=example,c=ru

debug_level = 255
auth_provider = ldap
chpass_provider = ldap
services = nss, pam
config_file_version = 2

domains = default





share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.