1

I am using ldap_access_filter in sssd.conf in order to limit access to users that are in a specific ldap group. However, when I do a "getent passwd" I still get a full list of the ldap users.

How can I limit the output to only the users of this specific group (preferably with SSSD)?

1 Answer 1

3

The only option to achieve this is to create an LDAP filter string to be used by the ldap_user_search_base config parameter (syntax: search_base[?scope?[filter][?search_base?scope?[filter]]*]).

This must be a valid RFC 2254 filter, and will likely somehow incorporate your ldap_access_filter into the ldap_user_search_base.

The reason for this is that applying the access filter is a second step after checking if an account exists, which will not be done by getent.

6
  • 2
    More specifically, it's a check implemented by the PAM module which has nothing to do with NSS. (which getent consults)
    – Andrew B
    May 27, 2015 at 16:24
  • I used the ldap_user_search_base successfully (incorporated my memberOf filter) but I still get a complete list of users with getent passwd. Any clues? May 27, 2015 at 17:27
  • 1
    Make sure to remove the cache and restart sssd after implemeting the filter.
    – jhrozek
    May 27, 2015 at 19:37
  • I have deleted the files in /var/lib/sss/db/, also the cache_credentials is set to false and the nscd is stopped. Maybe is something wrong with my /etc/ldap.conf and /etc/openldap/ldap.conf settings? (I am using SUSE) May 27, 2015 at 23:32
  • I checked today and the extra entries were gone, even though I deleted / disabled all the cache yesterday... Probably I missed something. Anyway, now it works.Thanks for your help people =) May 28, 2015 at 10:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .