3

I am trying to use LDAP for authentication. I see it doesn't work with RHEL 5, if we don't provide a bind DN and password, but works in RHEL 6 and 7.

From sssd logs, I can understand that it is using the username for which it is trying to authenticate as bind DN in RHEL 6 and 7, but not in RHEL 5.

Eg:

user = sam, base= ou=People,ou=HR,o=MyOrg

In RHEL 6&7, it succeeds by doing the following bind:

Executing simple bind as: uid=sam,ou=People,ou=HR,o=MyOrg

In RHEL 5, it is just:

Executing simple bind as: (null)

Openquery is not allowed at the server end. Hence, it fails in RHEL 5. (Server is not managed by us)

It seems to be a feature added in sssd in RHEL 6 and 7, but is it possible to achieve the same in RHEL 5?

I've also tried to achieve with ldap.conf in RHEL 6 and 7, but I couldn't figure out how to provide password. So, I guess it's a feature comes with SSSD.

migrated from serverfault.com Jun 19 '18 at 11:49

This question came from our site for system and network administrators.

0

Assuming you don't allow unauthenticated domain enumeration (you probably don't), you may want to consider the possibility that your RHEL 6 and 7 servers are actually using a Kerberos machine account to authenticate against the domain and perform an authenticated LDAP search, as this is the standard mechanism used by SSSD to maintain an authenticated connection to a given domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.