Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just built a test server running OpenSuSE 12.1 and am trying to learn how configure sssd, but am not sure where to begin to look for why my config cannot allow me to authenticate.

server:/etc/sssd # cat sssd.conf 
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss,pam

domains = test.local 

filter_groups = root
filter_users = root
reconnection_retries = 3

reconnection_retries = 3

# Section created by YaST
access_provider = ldap
ldap_uri = ldap://server.test.local
ldap_search_base = dc=test,dc=local
ldap_schema = rfc2307bis
id_provider = ldap
ldap_user_uuid = entryuuid
ldap_group_uuid = entryuuid
ldap_id_use_start_tls = True
enumerate = False
cache_credentials = True 
chpass_provider = krb5
auth_provider = krb5
krb5_realm = TEST.LOCAL

krb5_kdcip = server.test.local

server:/etc # cat ldap.conf 

base                            dc=test,dc=local
bind_policy                     soft
pam_lookup_policy               yes
pam_password                    exop
nss_initgroups_ignoreusers      root,ldap
nss_schema                      rfc2307bis
nss_map_attribute               uniqueMember member
ssl                             start_tls
uri                             ldap://server.test.local
ldap_version                    3
pam_filter                      objectClass=posixAccount

server:/etc # cat nsswitch.conf

passwd:         compat sss
group:          files sss

hosts:          files dns
networks:       files dns

services:       files
protocols:      files
rpc:            files
ethers:         files
netmasks:       files
netgroup:       files
publickey:      files

bootparams:     files
automount:      files ldap
aliases:        files
shadow:         compat

server:/etc # cat krb5.conf 

        default_realm = TEST.LOCAL
        clockskew = 300
        kdc = server.test.local
        admin_server = server.test.local
        database_module = ldap
        default_domain = test.local
        kdc = FILE:/var/log/krb5/krb5kdc.log
        admin_server = FILE:/var/log/krb5/kadmind.log
        default = SYSLOG:NOTICE:DAEMON
ldap = {
        db_library = kldap
        ldap_kerberos_container_dn = cn=krbContainer,dc=test,dc=local
        ldap_kdc_dn = cn=Administrator,dc=test,dc=local
        ldap_kadmind_dn = cn=Administrator,dc=test,dc=local
        ldap_service_password_file = /etc/openldap/ldap-pw
        ldap_servers = ldaps://server.test.local
        .test.local = TEST.LOCAL
pam = {
        ticket_lifetime = 1d
        renew_lifetime = 1d
        forwardable = true
        proxiable = false
        minimum_uid = 1
        clockskew = 300
        external = sshd
        use_shmem = sshd

If I log onto the server as root I can su into an ldap user, however if I try to console locally or ssh remotely I am unable to authenticate.

getent doesn't show the ldap entries for users, Im not sure if I need to look at LDAP, nsswitch, or what:

server:~ # ssh localhost -l test
Permission denied (publickey,keyboard-interactive).

server:~ # su test
test@server:/etc> id
uid=1000(test) gid=100(users) groups=100(users)

server:~ # tail /var/log/messages 

Nov 24 09:36:44 server login[14508]: pam_sss(login:auth): system info: [Client not found in Kerberos database]
Nov 24 09:36:44 server login[14508]: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=/dev/ttyS1 ruser= rhost= user=test
Nov 24 09:36:44 server login[14508]: pam_sss(login:auth): received for user test: 4 (System error)
Nov 24 09:36:44 server login[14508]: FAILED LOGIN SESSION FROM /dev/ttyS1 FOR test, System error

server:~ # vi /etc/pam.d/common-auth

auth    required
auth    sufficient
auth    required      use_first_pass

server:~ # vi /etc/pam.d/sshd
auth     requisite
auth     include        common-auth
account  requisite
account  include        common-account
password include        common-password
session  required
session  include        common-session
session  optional   silent noupdate showfailed
share|improve this question
Just a guess since I don't follow the example fully, have you created a host principal? – mxc Jan 10 '12 at 19:07

You haven't configured your access provider.
You have access_provider = ldap but you don't have ldap_access_filter configured anywhere.

From the man page on the ldap_access_filter option:

If access_provider = ldap and this option is not set, it will result in all users being denied access.

I would just remove the access_provider option altogether until you have a working configuration. Start simple, build up from there :-)


Note: there might also be a kerberos issue. It certainly sounds that way from the error log you posted. But while I don't know if kerberos is causing an issue, I do know this (what this answer covers) is.

share|improve this answer

Looks like PAM configuration issue to me.

Make sure that /etc/pam.d/sshd either references file (with @ directive) with sssd module or includes it directly.

share|improve this answer
Can you please elaborate? an example could be nice. – Itai Ganot Apr 13 '15 at 13:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.