Have a weird situation going on. Trying to setup sssd, but I am having issues when I set ldap_id_use_start_tls on sssd.conf.

In sssd.conf I have the following config:

ldap_id_use_start_tls = true
ldap_tls_cacert = /path/to/cert.pem
ldap_tls_reqcert = never

When I enable these options, I am not able to login to a new account on the server, I just get a message saying the password is invalid.

When I turn off the TLS options, everything works as expected, the new logins get their automatic home directory, etc..

I tried to validate my certificates with ldapsearch:

ldapsearch -D "DN of user" -W -h ldap.server.com -b "dc=ad,dc=site,dc=com" -s sub -ZZ "(objectclass=*)"

This query returns all of the ldiff information I was expecting. There is no issue with the LDAP server certificate according to OpenLDAP.

Any idea why sssd is failing on ldap_id_use_start_tls, but the ldapsearch looks like it's working fine?

  • This is Amazon Linux 2 btw – user28332 Feb 12 '18 at 18:11
  • 1
    You need to enable sssd logs using "debug_level" to see more information. But in general sssd just uses libldap, so if ldapsearch works, sssd should work, too. – jhrozek Feb 17 '18 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.