2

SETUP

OS = RHEL 6.4 Workstation

System is part of an LDAP domain and was originally configured to authenticate using nscd.

All recommended SSSD packages have been installed.

[root@sssd_system]#  rpm -qa | grep sssd
sssd-client-1.11.6-30.el6_6.4.x86_64
sssd-common-1.11.6-30.el6_6.4.x86_64
sssd-common-pac-1.11.6-30.el6_6.4.x86_64
sssd-krb5-common-1.11.6-30.el6_6.4.x86_64
sssd-ldap-1.11.6-30.el6_6.4.x86_64
sssd-proxy-1.11.6-30.el6_6.4.x86_64
sssd-tools-1.11.6-30.el6_6.4.x86_64

Files which have been created/modified to switch over to SSSD:

/etc/nsswitch.conf

[root@sssd_system]# ls -ld /etc/nsswitch.conf  
-rw-r--r-- 1 root root 560 Apr  9 12:07 /etc/nsswitch.conf

cat /etc/nsswitch.conf

passwd:     files sss  
shadow:     files sss  
group:      files sss  
ethers:     files sss  
services:   files sss  
netgroup:   files sss  


/etc/sssd/sssd.conf

[root@sssd_system]# ls -ld /etc/sssd/sssd.conf   
-rw------- 1 root root 971 Apr  9 11:48 /etc/sssd/sssd.conf

cat /etc/sssd/sssd.conf

[domain/default]  
ldap_schema = rfc2307bis  
ldap_uri = ldap://server1.domain.com,ldap://server2.domian.com  
ldap_search_base = dc=domain,dc=com  
ldap_user_search_base = ou=People,dc=domain,dc=com  
ldap_group_search_base = ou=Group,dc=domain,dc=com  
ldap_group_member = member  
id_provider = ldap  
auth_provider = ldap  
chpass_provider = ldap  
ldap_id_use_start_tls = False  
cache_credentials = True  
ldap_tls_cacertdir = /etc/openldap/cacerts  
ldap_tls_cacert = /etc/openldap/cacerts/certname.pem  
debug_level = 9


[sssd]
domains = default
services = nss,pam,autofs
config_file_version = 2
sbus_timeout = 30

NOTE: The authconfig command was used to configure this system, so in theory, that means that all the right files were touch with the correct information.


ISSUE 1

[USERID@sssd_system]# getent passwd USERID
USERID:*:12345:1002:USER ID:/home/USERID:/bin/bash

[USERID@sssd_system]#  getent group USERGRP  
USERGRP:*:1002:  

[USERID@sssd_system]# groups USERID  
USERID : groups: cannot find name for group ID 1002  
1002  

UPDATE: This issue turned out do be an error with the Groups table within ldap itself; it has been corrected.


ISSUE 2

[USERID@nscd_host]# groups USERID  
USERID: USERGRP USERGRP2 USERGRP3 USERGRP4 USERGRP5  

[USERID@nscd_host]# ssh USERID@sssd_system  
Red Hat Enterprise Linux Workstation release 6.4 (Santiago)  
Last login: Thu Apr  9 11:51:38 2015 from nscd_host  

[USERID@sssd_system]# groups USERID  
USERID: USERGRP  

QUESTION

What am I missing?

I've been researching the dickens for a solution to what is likely a simple configuration error, but haven't been able to pinpoint the exact config file(s). I've also reference Red Hat's documentation on setting up SSSD in their Deployment Guide and found several helpful guides posted out on the web.

And, I've also enabled debug level within sssd.conf file, but have not been able to find anything overtly meaningful within the logs /var/log/sssd/* log file(s) or /var/log/(message|secure) either.

Any assistance to what I might be missing would be greatly appreciated.

  • Not using AD, authenticating to a legacy unix/Solaris ldap setup here at the shop, but I'll check out the link you provided; at this point any assistance is welcomed. – LeonK Apr 10 '15 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.