I am using RHEL 7.2 image and trying to provide group based LDAP authentication using SSSD. How do I enable group based filters using SSSD?

I am attaching my sssd.conf file and I haven't enabled TLS on LDAP server (OpenDJ). I changed the value of FORCELEGACY to yes on client machine to connect without TLS.

Below is my sssd.conf file


 autofs_provider = ldap
 ldap_schema = rfc2307bis
 ldap_search_base = dc=mykronos,dc=internal
 id_provider = ldap
 auth_provider = ldap
 chpass_provider = ldap
 ldap_uri = ldap://[ldap-server-ip]:[port]
 ldap_id_use_start_tls = False
 cache_credentials = False
 ldap_tls_reqcert = allow
 ldap_tls_cacertdir = /etc/openldap/cacerts


 services = nss, pam, autofs
 config_file_version = 2
 domains = default


 homedir_substring = /home







 ldap_access_filter = memberOf=cn=test,ou=groups,dc=example,dc=com

I am unable to restrict users from groups other than test from logging into the machine.


Try this:

access_provider = simple
simple_allow_groups = g1, g2

See man sssd-simple for more information.

By the way - SSSD does not allow authentication without either TLS or SSL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.