Have a weird situation going on. Trying to setup sssd, but I am having issues when I set ldap_id_use_start_tls on sssd.conf.

In sssd.conf I have the following config:

ldap_id_use_start_tls = true
ldap_tls_cacert = /path/to/cert.pem
ldap_tls_reqcert = never

When I enable these options, I am not able to login to a new account on the server, I just get a message saying the password is invalid.

When I turn off the TLS options, everything works as expected, the new logins get their automatic home directory, etc..

I tried to validate my certificates with ldapsearch:

ldapsearch -D "DN of user" -W -h ldap.server.com -b "dc=ad,dc=site,dc=com" -s sub -ZZ "(objectclass=*)"

This query returns all of the ldiff information I was expecting. There is no issue with the LDAP server certificate according to OpenLDAP.

Any idea why sssd is failing on ldap_id_use_start_tls, but the ldapsearch looks like it's working fine?

  • This is Amazon Linux 2 btw – user28332 Feb 12 '18 at 18:11
  • 1
    You need to enable sssd logs using "debug_level" to see more information. But in general sssd just uses libldap, so if ldapsearch works, sssd should work, too. – jhrozek Feb 17 '18 at 15:54

Try to validate if its working with only the 2 first options:

ldap_id_use_start_tls = true

ldap_tls_cacert = /path/to/cert.pem

Also check that the cert.pem have the right permissions 0600 root:root.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.