Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am migrating a sealed MSA from using pam_ldap to pam_sss (sssd-ldap). However, pam_sss seems to have having trouble authenticating users without uidNumbers. I had thought changing ldap_user_object_class from posixAccount to top would fix this, but it has not. Users with uidNumbers seem to be fine. While it is to be expected that sssd would require uidNumbers for nss, I do not see why they would be necessary for pam.

syslog facility auth:

Aug  6 11:23:03 centos7-msa-test saslauthd[644]: pam_sss(smtp:auth): received for user non-posix-user: 10 (User not known to the underlying authentication module)

# cat /etc/pam.d/smtp
auth    sufficient
account sufficient

# cat /etc/sssd/sssd.conf
config_file_version = 2
services = pam
domains =
filter_groups = root
filter_users = root
reconnection_retries = 3
reconnection_retries = 3
id_provider = ldap
auth_provider = ldap
ldap_uri = ldap://, _srv_
ldap_user_object_class = top
ldap_search_base = dc=example,dc=com
ldap_user_search_base = ou=users,dc=example,dc=com?onelevel?
ldap_group_search_base = ou=groups,dc=example,dc=com?onelevel?
ldap_schema = rfc2307bis
ldap_id_use_start_tls = true
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/ca-bundle.crt

$ ldapsearch -ZZ -h -b ou=users,dc=example,dc=com -s one"(&(uid=non-posix-user)(objectClass=top))"
dn: uid=non-posix-user
objectClass: organizationalRole
objectClass: inetLocalMailRecipient
objectClass: simpleSecurityObject
objectClass: uidObject
cn: non-posix-user
roleOccupant: uid=posixuser1,ou=users,dc=example,dc=com
roleOccupant: uid=posixuser2,ou=users,dc=example,dc=com
userPassword:: e1NBU0x9bm9uLXBvc2l4LXVzZXJARVhBTVBMRS5DT00K
uid: non-posix-user
share|improve this question

At the moment, SSSD only handles system users, that is, users with IDs. The ID can either be defined in LDAP directly or derived from SID.

Your use-case is not supported by SSSD at the moment, sorry.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.