I've setup sssd and LDAP. Users authenticate and login. My problem is that sssd seems to ignore the ldap_access_filter option and allows all users to login. I've examined the logs/debug and pam_sss authorizes the users every time regardless of the filter (I've tried a couple different ones all with the same result).

This is the command used to configure the system:

    --updateall --passalgo=md5 --enableldap --enableldapauth  \
    --ldapserver=ldaps://ldap.example.com  \
    --ldapbase=ou=people,dc=example,dc=com \
    --enableldaptls --enableldapstarttls --disablekrb5 \
    --ldaploadcacert=http://certserver/cacerts/cacert.pem \
    --enablesssd --enablesssdauth --enableshadow \ 
    --enablecachecreds --enablemkhomedir

This is the /etc/sssd/sssd.conf:

debug_level = 9
ldap_id_use_start_tls = True
cache_credentials = True
ldap_search_base = ou=people,dc=example,dc=com
id_provider = ldap
auth_provider = ldap
ldap_access_filter = memberOf=cn=sysadmins,ou=people,dc=example,dc=com
chpass_provider = ldap
ldap_uri = ldaps://ldap.example.com
ldap_tls_cacertdir = /etc/openldap/cacerts
services = nss, pam
config_file_version = 2

domains = default






The pam.d/system-auth:

auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

Example /var/log/secure:

Dec 30 17:40:36 test login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=testacct
Dec 30 17:40:36 test login: pam_sss(login:auth): authentication success; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=testacct
Dec 30 17:40:36 test login: pam_unix(login:session): session opened for user testacct by LOGIN(uid=0)
Dec 30 17:40:36 test login: LOGIN ON tty1 BY testacct

The reason why it's not working is because you're not specifying an actual filter. You have to understand what a "filter" is, according to LDAP and SSSD. Here's my own sssd.conf with the filters.

My LDAP access filter is saying if the person logging in has host=servername or host=ALL, they can access that machine.


ldap_id_use_start_tls = True
cache_credentials = False
ldap_search_base = dc=example,dc=net?sub?|(host=palaceredirect.example.net)(host=ALL)
ldap_group_search_base = ou=Group,dc=example,dc=net
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
sudo_provider = ldap
ldap_uri = ldap://library.example.net
ldap_tls_cacertdir = /etc/openldap/cacerts
access_provider = ldap
ldap_access_filter = (|(host=palaceredirect.example.net)(host=ALL))
ldap_schema = rfc2307bis
enumerate = True
autofs_provider = ldap

config_file_version = 2
services = nss, pam, sudo, autofs

domains = default





You can ignore my search base. The point of that was to allow "enumerate = True" to work effectively for getent passwd.

| improve this answer | |

While I've always used /etc/security/access.conf to control server logon access, according to the doco (and Sokel's working example) you're possibly missing the "access_provider=ldap" line in sssd.conf.

| improve this answer | |
  • 2
    +1 for identifying the missing access_provider=ldap configuration option – Kevin S Feb 4 '16 at 15:49

Please try using the following as it worked for me for a centos based distro

access_provider = ldap
ldap_access_order = filter
ldap_group_member = member
ldap_access_filter = (memberOf=cn=vpn-clients,ou=Groups,dc=example,dc=com)
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.