Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying sssd for LDAP authentication, and while it can show user IDs with the id command, getent group and getent passwd do not show LDAP names, and while I can chown files to ldap users, they ls -lah as nobody.

A bit of digging and I found a hint: that this problem may occur when binding LDAP anonymously.

But when I setup sss, there was no option to supply a bind DN or password. I was also unable to locate the correct directive in the manual.

Where do I specify the Bind DN and password for sss+ldap? Does it go in /etc/sssd/sssd.conf? Or another file?

share|improve this question

1 Answer 1

You have to create a [domain] section in /etc/sssd/sssd.conf.

You could trawl through

man sssd-ldap

But it's quite a behemoth! This should get you stared. Not all directives here will be needed, depending on your environment.

[domain/default]
ldap_tls_reqcert = never
auth_provider = ldap
ldap_id_use_start_tls = False
chpass_provider = ldap
krb5_realm = EXAMPLE.COM
cache_credentials = True
debug_timestamps = True
ldap_default_authtok_type = password
ldap_search_base = dc=domain,dc=com,dc=br
debug_level = 3
id_provider = ldap
ldap_default_bind_dn = cn=Manager,dc=domain,dc=com,dc=br
min_id = 100
ldap_uri = ldap://<FQDN of LDAP Server>/
krb5_server = kerberos.example.com
ldap_default_authtok = xxxxxxxxxx
ldap_tls_cacertdir = /etc/openldap/cacerts
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.