0

I'm running a 389DS LDAPS server (with self-signed certificates) on a Fedora 30 remote machine called "miservidor.midominio.local". There I have a typical directory containing user and group entries.

I can retrieve directory data from another Fedora 30 machine (the client's one) wihout any problem. For instance, executing this command ("usu1ldap" is the name of an user located inside a "usuarios" organizationalunit)...:

LDAPTLS_REQCERT=never ldapsearch -H ldaps://miservidor.midominio.local -b "dc=midominio,dc=local" uid=usu1ldap

...I get:

enter image description here

But I want to login in client machine with "usu1ldap". So I've configured /etc/sssd/sssd.conf file in client machine like this...:

enter image description here

...I've executed sudo authselect select sssd to "automagically" configure NSS/PAM frameworks and finally I've restarted sssd service.

However, something doesn't work: getent passwd doesn't show "usu1ldap" user and, obviously, id usu1ldap retrieves "unknown user" too

What am I doing wrong? I've tried to grasp sssd's log files but without any clue. I'm a bit desperated...

Thanks a lot for your patience.

NOTE: Notice that in sssd.conf file I've had to assign the name and password of directory's manager to "ldap_default_bind_dn" and "ldap_default_authtok" lines respectively because my 389DS server by default doesn't allow anonymous queries and I don't know how to change this (yet).

0

Well, I’ve solved the issue: I forgot adding the services=nss,pam line in “/etc/sssd/sssd.conf” file (below [sssd] section. That was all. Oh my… I thought systemd could care of this (see https://docs.pagure.org/SSSD.sssd/design_pages/systemd_activatable_responders.html) but it seems it doesn’t.

For knowing all the full story until arriving to this (happy) end, you can read this full post: https://ask.fedoraproject.org/t/cant-authenticate-against-a-389ds-server-i-suspect-its-a-sssd-problem-on-the-client-side/3347

Thanks anyway

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.