I am trying to set up a couple of Linux workstations (RedHat 7), and I am trying to figure out how to set up authentication against an LDAP server with some unusual requirements.

I basically know how to set up LDAP authentication using sssd, but I don't know how to restrict authentication to only certain users to meet my requirement.

To enable LDAP configuration, I would use this command line:

authconfig --enableldap --enableldapauth --ldapserver="<redacted>" --ldapbasedn="<redacted>" --update --enablemkhomedir

This will allow all LDAP users to log on, and as far as I know works just fine. However, my requirement is that only some users from LDAP can log in, and the list of users will be supplied in a separate text file (by user login name).

More information: We have an LDAP server (Active Directory, actually) with a couple thousand users. Only about 20 of them who have a need to work on these workstations should be allowed to log on to these workstation. Unfortunately, LDAP does not include any information related to this, and I do not have control of the LDAP server. Instead, every couple of weeks, I get a text file with a list of the user names who should be allowed to log on.

How can I set up authentication to use LDAP for user name/password/user ID etc. while also restricting it to only users on this list?


Put those users into a group, then use a pam_access rule in /etc/security/access.conf to only allow logins if the user is in that group (and also for root, any sysadmins, and monitoring, if necessary) e.g.

+ : root wheel nagios : ALL
+ : yourusergrouphere : ALL
- : ALL : ALL
| improve this answer | |
  • I have no control over the LDAP server and cannot put them into a group - that's my problem! – Kevin Keane May 29 '17 at 17:07
  • After further research - pointing me to access.conf may still solve my problem. There are still a few pieces missing, but access.conf may be a crucial step along the way. Thanks! – Kevin Keane May 29 '17 at 18:45
  • To put those users into a group, then use a pam_access rule in /etc/security/access.conf, is this on the LDAP server or LDAP client? – OracleJavaNet Oct 27 '19 at 7:12

I found two ways to accomplish what I needed. The first was the one outlined by thrig. I had to add each user name individually to /etc/security/access.conf.

The second option is to specify an LDAP query string in sssd.conf:

ldap_access_filter = (|(userid=user1)(userid=user2).....)

The second solution is very tedious to build, but ends up having major performance benefits in large LDAP environments because sssd will only retrieve a few LDAP records.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.