Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sssd]

SSSD System Security Services Daemon provides an NSS and PAM interface to remote authenticators such as LDAP, Kerberos, FreeIPA.

10
votes
1answer
7k views

PAM vs LDAP vs SSSD vs Kerberos

I am basically aware of what these services do separate from each other. What I want to know: what exactly happens on a successful login in a linux based network that uses all of these services? In ...
6
votes
2answers
7k views

Missing config file for SSSD?

I want to make an CentOS 7 installation with LDAP authentication, so I installed authconfig-gtk, sssd and krb5-workstation. When I tried to start the service, I've got a message telling me that there ...
6
votes
1answer
3k views

Adding a system user to an LDAP group with SSSD

Our LDAP server is running RFC 2307 groups (memberuid contains a username, not a DN). With our old nscd/nss_ldap/pam_ldap setup, you could list a non-LDAP user (a system user from /etc/passwd) in an ...
6
votes
4answers
16k views

Allow AD Groups to SUDO

I'm adding some Fedora 20 workstations to our Windows 2003 domain. I've successfully joined the domain with the boxes, and can login with domain accounts. Now I'm trying to allow the default AD group ...
5
votes
2answers
730 views

Setting login shell in SSS configuration for users from Active Directory

I'm trying to define different login shells for different users of an AD domain, as described here. The aim is to deny members of a particular group from logging in while allowing them to do SSH ...
5
votes
1answer
206 views

Linux clients can't login on samba share while windows and mac can (active directory env)

Setup server Centos 7.6 Samba 4.8 Winbind SSSD Kerberos This machine is attached to the company active directory as member server but not domain controller (I followed the RadHat documentation to ...
4
votes
3answers
5k views

Join Redhat 7 without prompting the password

I am trying to automate domain join on RedHat 7 using the following command: realm join -U serviceaccount --client-software=sssd abc.com The problem is this command prompts for password which stops ...
4
votes
1answer
218 views

SELinux Interfering With sss_cache

System: HP Pavilion Power Laptop 15-cb0xx Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios) Fedora 28 NVIDIA GTX 1050 (mobile) I used the dnfdragora GUI to update about ...
4
votes
2answers
2k views

Configure SSSD (sudo and dyndns_update) with realmd

I'm trying to join a Ubuntu 16.04 to a Windows domain (active directory) using realmd + sssd. Basically I was following this post which worked pretty well and I was able to join my server and could ...
4
votes
1answer
2k views

getent passwd -s sss LOCALUSER shows local user

tl;dr I want to easily and quickly tell if a user is local or domain (don't care which domain). Environment freeipa-client-4.6.1-3.fc27.x86_64 sssd-1.16.0-4.fc27.x86_64 Full story I am writing a ...
4
votes
1answer
477 views

How to debug authentication failures?

I have a Raspberry Pi that I have connected to our AD domain using realm. It is using sssd-ad to perform user authentication. All accounts in the child domain to which the Pi is joined worked. However ...
4
votes
1answer
3k views

How do I clear a user's cached Active Directory password on CentOS 7?

I built a CentOS 7 install on my company laptop and configured it to authenticate to the company AD servers like so: Install packages: yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-...
4
votes
1answer
3k views

Force authentication to use sssd not nslcd

What I did was: vim /etc/sysconfig/authconfig USESSSDAUTH=yes USESSSD=yes FORCELEGACY=no Then: authconfig --enablesssd --enablesssdauth --enablelocauthorize --update ...
4
votes
1answer
4k views

sudo and sssd not working with user groups

Having a problem getting sudo that is integrated with sssd to work correctly when we use ldap to store the groups that have the different sudo privs. This works just fine if we have sudo set to go to ...
4
votes
1answer
1k views

How to run script when SSSD creates home directory for a new user

I have a network with several RHEL6 workstations and RHEL IdM Server (a.k.a. FreeIPA) as a domain controller. Every LDAP user can log into the every workstation. When the user is logging in for the ...
4
votes
0answers
1k views

Centos 7 AD authentication DataProvider is Offline

I have configured my Linux machine to use AD authentication. Sometimes few nodes are unable to login. The /var/log/sssd/sssd_nss.log log file reports the message below: Thu Sep 13 13:31:39 2018) [...
4
votes
0answers
3k views

SSSD For Authentication & SAMBA For File Sharing [duplicate]

As an alternative to winbindd, I have setup SSSD on a machine so that it can authenticate AD domain accounts, which is working great. However, this same machine also needs to act as a file server, so ...
4
votes
0answers
5k views

sssd configuration with Active directory

I need to configure the sssd so that we can use Windows Active directory username to login to Redhat machine. I have below configuration file for sssd.conf file I get the following error in log. ...
3
votes
2answers
4k views

oddjob_mkhomedir doesn't run when logging in via SSH with Kerberos

I currently have a server which has Kerberos/SSSD/Samba to authenticate to Windows 2012 AD. In /etc/pam.d/system-auth oddjob_mkhomedir is set as below: session optional pam_oddjob_mkhomedir....
3
votes
1answer
2k views

Mapping AD groups to Linux groups - sssd and Windows server 2016

I have a setup with RHEL 7.4 machines that connect to Active Directory (AD) running on a Windows Server 2016 Datacenter Edition. The Linux machines are in direct integration with the AD. Since ...
3
votes
1answer
221 views

sssd or ldap.conf doesn't work without a bindDN and password in RHEL 5, but works in RHEL 6 and 7. Why?

I am trying to use LDAP for authentication. I see it doesn't work with RHEL 5, if we don't provide a bind DN and password, but works in RHEL 6 and 7. From sssd logs, I can understand that it is ...
3
votes
0answers
671 views

auto groups in CentOS 7 in Active Directory domain?

I am having an issue that might be mostly cosmetic but I've gotta keep the user complaints down. :) I have a set of servers running CentOS 7.4 and have the requirement to join the servers to an ...
3
votes
1answer
980 views

Get sudoers through LDAP (SUSE Linux Enterprise Server 12)

I have a problem with my LDAP configuration on SUSE Linux Enterprise Server 12. As many of you know, the ldap.conf file has been replaced with sssd.conf and a couple of other conf files like nsswitch....
3
votes
1answer
968 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
2
votes
1answer
2k views

pam_faillock and AD/CentOS 7.2

So, I have a CentOS 7.2 system and I used realmd to join the AD domain. I can do a # id {username}@{domain} which perfectly lists all of the AD information for that user. Awesome! Using stock pam.d/...
2
votes
1answer
5k views

sssd realm discover: Not authorized to perform this action

I am testing sssd on CentOS and am unable to progress as per the error below: [root@sssd-testing ~]# realm discover realm: Couldn't discover realms: Not authorized to perform this action [root@sssd-...
2
votes
1answer
2k views

SSSD and autofs

I am trying to set up SSSD to get automount maps from Active Directory. I think my settings are correct but it uses the wrong username to query AD. It takes whatever that is set as "mapname" (behind ...
2
votes
2answers
9k views

sssd: login problems with AD user

I've setup my samba4 DC to get account information from a central AD provider via sssd. What I'd like to do now is permit some subset of these users to login via ssh (to linux machines) or via RDP (to ...
2
votes
3answers
9k views

Edit home directory for an LDAP user in Linux

I have an LDAP user who accesses a server based on having the appropriate LDAP host attribute via sssd. This user does not show up in /etc/passwd because he is not local. How do I modify his home ...
2
votes
1answer
206 views

How to Specify Group Owner During Cron

I've done a fair amount of research but either I'm having trouble formulating the context to create relevant results or the information is hard to find. I have a production ubuntu 16.04 server ...
2
votes
1answer
1k views

sssd and Active Directory user does not exist in CentOS

When I try to do a su user1@ADREALM.COM I get a "user does not exist" message. user1@ADREALM.COM exists in Active Directory. I can do kinit user1@ADREALM.COM successfully and get a ticket. Here are ...
2
votes
2answers
3k views

LDAP Sudoers w/ AD & SSSD (returns only primary group)

I'm having issues getting LDAP sudoers rules to work. My environment is: Active Directory on Windows Server 2012 R2 Ubuntu 16.04.2 SSSD 1.13.4-1ubuntu1.5 sudo 1.8.20-3 (latest as of the posting, ...
2
votes
1answer
390 views

How to understand this SSSD log?

(Wed Apr 19 14:16:47 2017) [sssd[be[xx.xx.COM]]] [sdap_get_generic_op_finished] (0x0400): Search result: Referral(10), 0000202B: `RefErr`: DSID-03100781, data 0, 1 access points What does this mean?
2
votes
1answer
407 views

SSSD: Why does setting ldap_group_nesting_level to “0” improve the performance greatly?

What is the default value for this parameter if I don't mention it in the configuration file? In a hundred of people enterprise environment, multiple tools - CDH Hadoop, analytics tool, Tableau, ...
2
votes
1answer
307 views

Sending sssd.log to syslog

How do I configure SSSD to send logs to syslog? I would like to include the SSSD debug logs as well. We would like to feed the sssd logs to Splunk. Our systems are already configured to send syslog to ...
2
votes
1answer
2k views

SSSD Centos 7 AD Binding - only some users are able to login

I have been trying to nail down the process of binding a Centos 7 install to a Windows domain but am struggling. I have managed to successfully do this in the past on a couple of boxes but I am now ...
2
votes
0answers
910 views

sssd not working over ldap_id_use_start_tls

Have a weird situation going on. Trying to setup sssd, but I am having issues when I set ldap_id_use_start_tls on sssd.conf. In sssd.conf I have the following config: [domain] ldap_id_use_start_tls =...
2
votes
1answer
4k views

LDAP user does not exist when running 'su'

I'm attempting to set up LDAP authentication according to the instructions in Sander Van Vugt's RHCSA/RHCE book for RHEL7. In chapter 6 he explains that when using authconfig-tui the FORCELEGACY ...
2
votes
1answer
701 views

Login not chdir()ing to correct home directory (AD/realmd/sssd)

I'm forced (ugh) to join several linux machines to a domain. I'm currently using debian stable, and am joining the machines using a join script I wrote (at https://rbmj.github.io/join.sh for ...
2
votes
0answers
299 views

Override local sudo defaults using sss or ldap

I'm trying to to configure an IPA domain to use the following sudo options for a specific command group: !authenticate !requiretty visiblepw Locally, the following defaults are set in /etc/sudoers: ...
2
votes
0answers
411 views

ldap 389 server with sssd client, cannot modify password

I setup the 389 ldap server on a fedora system. I can authenticate against the system, but I cannot update/modify a password neither as root nor as user. user root gets a "Password reset by root is ...
2
votes
0answers
5k views

How do I view multiple users groups using sssd?

SETUP OS = RHEL 6.4 Workstation System is part of an LDAP domain and was originally configured to authenticate using nscd. All recommended SSSD packages have been installed. [root@sssd_system]#...
2
votes
1answer
619 views

Utilizing Samba Shares Without using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
2
votes
0answers
498 views

ACL for a binddn user for PAM?

I've installed 389-ds and created a user and a couple groups. I then configured authconfig on a client to use the LDAP instance to authenticate the user. I've logged in successfully as that user. All ...
1
vote
2answers
614 views

Using openldap authentication only for some users

I am trying to set up a couple of Linux workstations (RedHat 7), and I am trying to figure out how to set up authentication against an LDAP server with some unusual requirements. I basically know how ...
1
vote
1answer
150 views

Sudo long wait for Active Directory user

My Fedora 26 (was 25 when installed/joined to AD) has a long timeout when I run sudo for my Active Directory user if I leave it alone for to long. Timeout is long. 25 seconds. I used strace (sudo ...
1
vote
3answers
446 views

Allow AD group to access samba share

On my Linux I created a samba share like this, it was working fine. [global] security = user passdb backend = tdbsam map to guest = Bad User guest account = mcms [mml-t1] path = /...
1
vote
1answer
794 views

SSSD delete users

It is my first question on the forum, so please, don't be mad if I miss important information about my issue. I use Debian 8 and I joined an Active Directory domain (Windows server 2012) with SSSD ...
1
vote
1answer
160 views

SSSD Domain Configuration Snippets

Generally, it seems, the idea with conf.d-style directories is to allow a very modular, drop-in method to add features or configurations. With SSSD, specifically, it would seem logical to add further ...
1
vote
1answer
370 views

“map passwd uid” equivalent in sssd

nslcd.conf has "map passwd uid" to map attributes that will be used as the Login username. What is the sssd.conf equivalent of that?