Situation today: we've got a functional sssd-config on multiple Ubuntu-clients. This config contains authenticating against a LDAP-server. The SASL-Mech is as "gssapi" specified and uses a krb5-keytab-file. Bombastic feauture: the specified user of the keytab-file expires every 90 days. Not that bad, but replacing the keytab-file on the clients will take a long time and additional is more risky.

Situation tomorrow will be: if possible we'd like to use the credentials used to log in, because the LDAP isn't anonymous-readable and every domain user will have read access. Actually, I don't have an idea to put the active login-credentials to sssd to check authentication against LDAP. Any assistance would be appreciated!

Before asking to not expire this user: we're in some complex network, which is not administrated by ourself and we're only allowed to use those users.


You can use ldap_default_bind_dn together with ldap_default_authtok_type=password and then put the login credentials into ldap_default_authtok.

  • Thanks for reply! Correct if misunderstood: global /etc/sssd/sssd.conf would get the credentials for one specific user? That wouldn't be some new configuration aside our keytab? Or is there a way to set authtok dynamically at login? – CBuchey Oct 30 '15 at 8:46
  • It would be one specific user (normally called "the bind user"). There is no way to retrieve the identity data with the user's credentials, mostly because in UNIX, the way to retrieve the identity data is completely separate from authentication (NSS vs PAM interface) – jhrozek Nov 1 '15 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.