I have been spending many, many happy hours exploring the sssd configuration needed to integrate RHEL7 and Active Directory. A large portion of those have included looking through the many posts here on SSSD and AD integration, particularly to do with local UID lookups in AD. Whilst these have been enlightening, none seem to cover my scenario.
My problem at present is that I can login via SSH using a windows user ("DOMAIN1\sales1" using the windows user's password) and SSSD will validate the state of the windows user correctly. If the windows user is disabled, or the account is expired, the login fails - all as it should be.
If I login via SSH using a linux user with the same id as the windows user ("sales1" using the linux user's password) SSSD will lookup and match the windows user in AD but will NOT validate the AD account. I have applied the linux users UID to the uidNumber attribute of the windows user in order to help the AD-linux user match, but nothing I try seems to influence the AD user state validation when logging in using linux user credentials.
[sssd] domains = domain1.local config_file_version = 2 services = nss, pam debug_level = 7 [domain/domain1.local] ad_domain = domain1.local krb5_realm = DOMAIN1.LOCAL realmd_tags = manages-system joined-with-adcli id_provider = ad auth_provider = ad access_provider = ad chpass_provider = ad ## We do NOT want offline caching of Windows authentications cache_credentials = False krb5_store_password_if_offline = False ## Found this ticket for sssd: https://fedorahosted.org/sssd/ticket/2851 ## might be the GC lookup that is stopping expired users from being denied access ad_enable_gc = False ldap_id_mapping = False override_homedir = /home/%u default_shell = /bin/bash debug_level = 8
passwd: files sss shadow: files sss group: files sss hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files sss netgroup: files sss publickey: nisplus automount: files aliases: files nisplus
(as configured by authconfig)
#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so
Is what I am attempting to achieve at all viable using SSSD?
I am very new to sssd and the impact of the AD integration on a RHEL system, so I think my approach to solving my requirements is all wrong.
I have an existing RHEL stand-alone server running an application that uses the linux user authentication (passwd, shadow, groups). I have been given the requirement to validate application users within ad prior to allowing their access to the linux application. The application MUST continue to use existing linux user and group ids as it is not currently capable of dealing with either long windows users or user id with "@", and a large portion of the acl behaviour is built on the existing group.
My original approach (which lead to the asking of this question) was to use sssd & realm to join RHEL to AD and then (via pam/sssd ) get the linux login to find a matching AD user for the linux user, most likely using POSIX attributes on the windows user, and validate their AD account.
I think what I actually need to achieve is
- Establish a map/relationship between an AD user and a local linux user that uses the application
When such a map/relationship exists:
- Only require the AD password at login
- Validate the AD account access status (account enabled/not expired/GPO logon rights/member of the right AD group)
- Always use the local username, uid, and gid of the mapped user
I think using the
realm permit --groups firstname.lastname@example.org will allow me to restrict AD user logins to a specific AD group (we do not currently want to have windows users logging into linux, outside of the above application use case).
What I am not sure about is the best way to map AD users to existing linux users. The application currently creates and maintains the linux user accounts so any solution needs to be able to work with this.
From what I have read over the past 2 weeks, I think my options are:
- Use SSSD local overrides to map between AD and linux users.
I have no experience with this so am relying on articles like SSSD Local overrides as indicators that this is viable
- Rely on POSIX attributes being defined on the AD user.
This does imply that these values will be used by the user on EVERY server they connect to that also references the POSIX attributes. I'm not sure if this is sensible in the long term. Testing has shown that with the uid, uidNumber, and gidNumber defined on a windows user when the user logs in linux uses these values. This does impose a maintenance effort to ensure these values are defined on the AD user.
- Install IPA and use id views.
I have no experience with installing or setting this up, but my reading indicates this is a possible option. There does seem to be additional installation, configuration and maintenance costs for using this option.
So I think I now need to confirm if these are indeed the only options, or if there are others I am not aware of, and of the available options which is best suited to my minimal AD integration need.