I am trying to limit LDAP logins to the "admin" group.

This is my /etc/sssd/sssd.conf file:

autofs_provider = ldap
ldap_tls_reqcert = allow
auth_provider = ldap
ldap_id_use_start_tls = False
chpass_provider = ldap
cache_credentials = True
debug_timestamps = True
ldap_default_authtok_type = password
ldap_search_base = dc=example,dc=com
id_provider = ldap
ldap_default_bind_dn = cn=moderator,ou=moderators,ou=test,o=organization,dc=example,DC=COM
min_id = 100
ldap_uri = ldaps://example.com:636/
ldap_default_authtok = Pa$$word
ldap_tls_cacertdir = /etc/openldap/cacerts/
ldap_tls_cert = /etc/openldap/cacerts/certificate.pem
access_provider = ldap
ldap_access_filter = memberOf=cn=admin,ou=group,o=organization,dc=example,dc=com

services = nss, pam, autofs
domains = default
homedir_substring = /home









I have tried to do id username and it comes up with:

id user uid=90514(user) gid=20000(users) groups=20000(users),2480(admin)

When trying to change the user by doing su user it gives error su: Permission denied after the passord is entered. When removing group limitation entries from sssd.conf, it works as expected and lets the user to login.

Any ideas where I have messed up?

Edit: For now I will set it up with /etc/security and PAM and that works. However I am still curious about doing it with sssd.

  • Have you tried doing ssh user@localhost instead? Sometimes su can have additional restrictions or be disabled?
    – shearn89
    Dec 20, 2021 at 11:20
  • Still fails. Dec 20 11:50:37 localhost sshd[1419]: pam_sss(sshd:account): Access denied for user user: 6 (Permission denied) Dec 20 11:50:37 localhost sshd[1419]: Failed password for user from port 50592 ssh2 Dec 20 11:50:37 localhost sshd[1419]: fatal: Access denied for user user by PAM account configuration [preauth]
    – Iggy
    Dec 20, 2021 at 11:53

2 Answers 2


according to https://www.mankier.com/5/sssd-ldap:

ldap_access_filter (string)

If using access_provider = ldap and ldap_access_order = filter (default), this
option is mandatory. It specifies an LDAP search filter criteria that must be met
for the user to be granted access on this host.

If access_provider = ldap, ldap_access_order = filter and this option is not set,
it will result in all users being denied access. Use access_provider = permit to
change this default behavior.

So apparently, adding access_provider = permit should fix your issue.


Does the overlay memberOf exist in your LDAP configuration ? As far as I understand, this overlay needs to be explicitly configured before it can be used.

The following command's output should contain something such as 'memberof.la'. If not, then you probably should configure your LDAP server in the first place.

slapcat -n 0 | grep olcModuleLoad

This might be helpful: https://tylersguides.com/guides/openldap-memberof-overlay/#configuration_tag https://stackoverflow.com/questions/60994495/memberof-and-refint-does-not-work-in-openldap

  • Thank you! will test this later, but most likely this is the problem! For now i just did it via /etc/security and PAM, but i am curious about trying to do it this way.
    – Iggy
    Dec 20, 2021 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.