I have been able to setup 389 LDAP server and SSSD client authentication. However, whenever I login using ldap user after each login it displays the error
ttt@dsl's password: Last login: Thu Dec 6 12:52:06 2012 id: cannot find name for group ID 6006
I tried with multiple different users and multiple types. I am using Centos 6 on both server and client side. getent shadow does not return ldap users and this feature request have been denied by Redhat.https://bugzilla.redhat.com/show_bug.cgi?id=751291.
Or shall I switch back to nss_ldap/pam_ldap, but I may not get password caching that sssd provides.
root@dsl etc]# cat /etc/sssd/sssd.conf [domain/default] ldap_tls_reqcert = never ldap_id_use_start_tls = True cache_credentials = True ldap_search_base = dc=ma,dc=net #krb5_realm = EXAMPLE.COM #krb5_server = kerberos.example.com ldap_group_member = uniquemember id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldaps://ldap.ma.net ldap_tls_cacertdir = /etc/openldap/cacerts krb5_realm = EXAMPLE.COM krb5_server = kerberos.example.com enumerate = false [sssd] services = nss, pam config_file_version = 2 #domains = LDAP domains = [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd [pam] reconnection_retries = 3 offline_credentials_expiration = 2 offline_failed_login_attempts = 3 offline_failed_login_delay = 5 [sudo] [autofs] [ssh] [root@dsl etc]#
After login as user I can successfully execute id command, still wondering why it always says no such group.
[root@ldap02 ~]# ssh ttt@dsl ttt@dsl's password: Last login: Thu Dec 6 13:18:16 2012 from 10.2.3.69 id: cannot find name for group ID 6006 [ttt@dsl ~]$ id ttt uid=6006(ttt) gid=6006 groups=6006
[root@dsl ~]# groups ttt ttt : groups: cannot find name for group ID 6006 6006 [root@dsl ~]# groups ttt