1

I have installed openLDAP, MIT Kerberos and SSD on Debian 10 Systems based on this tutorial Integrated Kerberos-OpenLDAP provider on Debian squeeze.
Each of the three components is on its own Proxmox LXC Container.
ldap: 192.168.1.120 (ldap2)
Kerberos: 192.168.1.128 (kerb)
Client with SSD: 192.168.1.129 (test)
The IPs can be resolved by DNS.

The Problem:
When I call 'id username' I get no result.
But with the same filter I get a result with ldapsearch.

Log on Client after 'id test05' (SSD loglevel 6)

==> /var/log/sssd/sssd_nss.log <==
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [accept_fd_handler] (0x0400): Client connected!
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1].
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1].
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [nss_getby_name] (0x0400): Input name: test05
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_send] (0x0400): CR #1: New request 'User by name'
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_process_input] (0x0400): CR #1: Parsing input name [test05]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'test05' matched without domain, user is test05
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_set_name] (0x0400): CR #1: Setting name [test05]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_select_domains] (0x0400): CR #1: Performing a multi-domain search
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_domains] (0x0400): CR #1: Search will check the cache and check the data provider
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_set_domain] (0x0400): CR #1: Using domain [xxxxxxx.net]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_prepare_domain_data] (0x0400): CR #1: Preparing input data for domain [xxxxxxx.net] rules
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_send] (0x0400): CR #1: Looking up test05@xxxxxxx.net
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #1: Checking negative cache for [test05@xxxxxxx.net]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #1: [test05@xxxxxxx.net] is not present in negative cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #1: Looking up [test05@xxxxxxx.net] in cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #1: Object [test05@xxxxxxx.net] was not found in cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #1: Looking up [test05@xxxxxxx.net] in data provider
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x55bd0978aee0:1:test05@xxxxxxx.net@xxxxxxx.net]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [xxxxxxx.net][0x1][BE_REQ_USER][name=test05@xxxxxxx.net:-]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x55bd0978aee0:1:test05@xxxxxxx.net@xxxxxxx.net]

==> /var/log/sssd/sssd_xxxxxxx.net.log <==
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=test05@xxxxxxx.net]
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_attach_req] (0x0400): DP Request [Account #3]: New request. Flags [0x0001].
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_attach_req] (0x0400): Number of active DP request: 1
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [ou=users,dc=lan,dc=xxxxxxx,dc=net]
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=test05)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][ou=users,dc=lan,dc=xxxxxxx,dc=net].
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sdap_get_generic_op_finished] (0x0400): Search result: No such object(32), no errmsg set
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results.
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sysdb_search_by_name] (0x0400): No such entry
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory)
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_req_done] (0x0400): DP Request [Account #3]: Request handler finished [0]: Success
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [_dp_req_recv] (0x0400): DP Request [Account #3]: Receiving request data.
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #3]: Finished. Success.
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1::xxxxxxx.net:name=test05@xxxxxxx.net] from reply table
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_req_destructor] (0x0400): DP Request [Account #3]: Request removed.
(Thu Jan 16 16:03:48 2020) [sssd[be[xxxxxxx.net]]] [dp_req_destructor] (0x0400): Number of active DP request: 0

==> /var/log/sssd/sssd_nss.log <==
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #1: Looking up [test05@xxxxxxx.net] in cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #1: Object [test05@xxxxxxx.net] was not found in cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_search_ncache_add_to_domain] (0x0400): CR #1: Adding [test05@xxxxxxx.net] to negative cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/xxxxxxx.net/test05@xxxxxxx.net] to negative cache
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [cache_req_process_result] (0x0400): CR #1: Finished: Not found
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x55bd0978aee0:1:test05@xxxxxxx.net@xxxxxxx.net]
(Thu Jan 16 16:03:48 2020) [sssd[nss]] [client_recv] (0x0200): Client disconnected!

/var/log/syslog on the ldap2 host (only 3 lines with loglevel 256)

Jan 16 16:03:48 ldap2 slapd[238]: conn=1067 op=6 SRCH base="ou=users,dc=lan,dc=xxxxxxx,dc=net" scope=2 deref=0 filter="(&(uid=test05)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))"
Jan 16 16:03:48 ldap2 slapd[238]: conn=1067 op=6 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host rhost loginDisabled loginExpirationTime loginAllowedTimeMap sshPublicKey userCertificate;binary mail
Jan 16 16:03:48 ldap2 slapd[238]: conn=1067 op=6 SEARCH RESULT tag=101 err=32 nentries=0 text=

As you can see the openLDAP search is called with
base: ou=users,dc=lan,dc=xxxxxxx,dc=net
filter:

(&(uid=test05)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0)))) 

When I do this search directly on the openLDAP host I get a result:

ldapsearch -Y GSSAPI -b ou=users,dc=lan,dc=xxxxxxx,dc=net "(&(uid=test05)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))" cn  uid
SASL/GSSAPI authentication started
SASL username: ldapadm@XXXXXXX.NET
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <ou=users,dc=lan,dc=xxxxxxx,dc=net> with scope subtree
# filter: (&(uid=test05)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))
# requesting: cn uid 
#
.
# test05, users, lan.xxxxxxx.net
dn: uid=test05,ou=users,dc=lan,dc=xxxxxxx,dc=net
cn: test05
uid: test05

/var/log/syslog on the ldap2 host

Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 fd=24 ACCEPT from IP=[::1]:37252 (IP=[::]:389)
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=0 BIND dn="" method=163
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: 
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=1 BIND dn="" method=163
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: 
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=2 BIND dn="" method=163
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=2 BIND authcid="ldapadm@XXXXXXX.NET" authzid="ldapadm@XXXXXXX.NET"
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=2 BIND dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" mech=GSSAPI sasl_ssf=256 ssf=256
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=2 RESULT tag=97 err=0 text=
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=3 SRCH base="ou=users,dc=lan,dc=xxxxxxx,dc=net" scope=2 deref=0 filter="(&(uid=test05)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))"
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=3 SRCH attr=cn uid
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text=
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 op=4 UNBIND
Jan 16 16:19:08 ldap2 slapd[238]: conn=1068 fd=24 closed
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 fd=24 ACCEPT from IP=[::1]:37254 (IP=[::]:389)
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=0 BIND dn="" method=163
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: 
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=1 BIND dn="" method=163
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: 
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=2 BIND dn="" method=163
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=2 BIND authcid="ldapadm@XXXXXXX.NET" authzid="ldapadm@XXXXXXX.NET"
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=2 BIND dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" mech=GSSAPI sasl_ssf=256 ssf=256
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=2 RESULT tag=97 err=0 text=
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=3 SRCH base="ou=users,dc=lan,dc=xxxxxxx,dc=net" scope=2 deref=0 filter="(&(uid=test05)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))"
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=3 SRCH attr=cn uid
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text=
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 op=4 UNBIND
Jan 16 16:19:30 ldap2 slapd[238]: conn=1069 fd=24 closed

My SSSD configuration

cat /etc/sssd/sssd.conf 
[sssd]
config_file_version = 2
services = nss, pam
domains = xxxxxxx.net

[nss]
debug_level = 6
override_shell = /bin/bash
filter_users = root
filter_groups = root

[pam]
offline_credentials_expiration = 60

[domain/xxxxxxx.net]

# A domain with identities provided by LDAP and authentication by Kerberos

debug_level = 6
cache_credentials = true

# -- Authentication provider --
auth_provider = krb5
krb5_server = kerb.xxxxxxx.net
krb5_realm = XXXXXXX.NET
krb5_ccachedir = /tmp

# -- Access provider --
access_provider = permit

# -- Change Password provider --
chpass_provider = krb5

# -- Identity provider --
id_provider = ldap
ldap_uri = ldap://ldap2.xxxxxxx.net
ldap_search_base = dc=lan,dc=xxxxxxx,dc=net
ldap_user_search_base = ou=users,dc=lan,dc=xxxxxxx,dc=net

ldap_sasl_mech = GSSAPI
ldap_sasl_authid = host/test.xxxxxxx.net
ldap_krb5_keytab = /etc/ldap/ldap.keytab
ldap_krb5_init_creds = true

# -- SUDO provider -- 
sudo_provider = none

This is my LDAP configuration

# config
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcAuthzRegexp: {0}"uid=ldapadm,cn=XXXXXXX.NET,cn=gssapi,cn=auth" "cn=admin,
 dc=lan,dc=xxxxxxx,dc=net"
olcAuthzRegexp: {1}"uid=([^,]+),cn=gssapi,cn=auth" "uid=$1,ou=users,dc=lan,dc=
 xxxxxxx,dc=net"
olcAuthzRegexp: {2}"uid=([^,]+),cn=XXXXXXX.NET,cn=gssapi,cn=auth" "uid=$1,ou
 =users,dc=lan,dc=xxxxxxx,dc=net"
olcAuthzRegexp: {3}"uid=host/([^,]+).XXXXXXX.NET,cn=xxxxxxx.net,cn=gssapi,
 cn=auth" "cn=$1,ou=hosts,dc=lan,dc=xxxxxxx,dc=net"
olcDisallows: bind_anon
olcLogLevel: 256
olcPidFile: /var/run/slapd/slapd.pid
olcRequires: authc
olcSaslHost: ldap2.xxxxxxx.net
olcSaslRealm: XXXXXXX.NET
olcTLSCACertificateFile: /etc/ssl/openldap/certs/ca-chain-cert.pem
olcTLSCertificateFile: /etc/ssl/openldap/certs/ldap2-server-cert.pem
olcTLSCertificateKeyFile: /etc/ssl/openldap/private/ldap2-server-key.pem
olcTLSProtocolMin: 3.1
olcToolThreads: 1

# {0}config, config
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external
 ,cn=auth manage by * break
olcRootDN: cn=admin,cn=config

# {1}mdb, config
dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=lan,dc=xxxxxxx,dc=net
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=lan,dc
 =xxxxxxx,dc=net" write by dn="cn=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=
 net" read by dn="cn=mailman,ou=vmail,ou=services,dc=lan,dc=xxxxxxx,dc=net" 
 read by self write by anonymous auth by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to dn.subtree="ou=vmail,ou=services,dc=lan,dc=xxxxxxx,dc=net" 
 by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write by dn="cn=mailman,ou=vmail,
 ou=services,dc=lan,dc=xxxxxxx,dc=net" read by self write by anonymous auth 
 by * none
olcAccess: {3}to dn.subtree="cn=krb5,ou=services,dc=lan,dc=xxxxxxx,dc=net" b
 y dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write by dn="cn=adm-srv,cn=krb5,ou
 =services,dc=lan,dc=xxxxxxx,dc=net" write by dn="cn=kdc-srv,cn=krb5,ou=serv
 ices,dc=lan,dc=xxxxxxx,dc=net" read by * none
olcAccess: {4}to * by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write by dn="cn
 =sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=net" read by self write by anonymo
 us auth by * none
olcLastMod: TRUE
olcRootDN: cn=admin,dc=lan,dc=xxxxxxx,dc=net
olcRootPW: {SSHA}...

I'm struggling with this problem for two days now. google was no help.

Can anybody help me to fix this?

1

Your olcAccess statements are too strict to allow the principal used by sssd to read that data that you want it to see.


The offending line is:

olcAccess: {4}to *
 by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write
 by dn="cn=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=net" read
 by self write
 by anonymous auth
 by * none

You probably want something like:

olcAccess: {4}to *
 by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write
 by dn="cn=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=net" read
 by dn.one="ou=hosts,dc=lan,dc=xxxxxxx,dc=net"
 by self write
 by anonymous auth
 by * none

This assumes your olcAuthzRegexp: {3} statement is working as you want it, but I'd check to make sure about that too. (kinit -k and ldapwhoami -Y will be your friends for that.)


You could also make a more specific olcAccess with to attrs=@posixAccount,@posixGroup by ....

0

Thank you very much for your answer. You are absolutely right.
I didn't think about an authentication error because there is no message about that in the logs.

When I change the olcAccess statement to

olcAccess: {4}to * 
 by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write 
 by dn="cn=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=net" read 
 by self write 
 by anonymous auth 
 by * read    <--- this works, but it is not what I want

it works.

Then changed my configuration according to your suggestions and everything is ok. Here are the changes I made:

  1. changed olcAuthzRegexp statement to
dn: cn=config
add: olcAuthzRegexp
olcAuthzRegexp: "uid=host/([^,]+).xxxxxxx.net,cn=gssapi,cn=auth" "cn=$1,ou=hosts,ou=sssd,ou=services,dc=lan,dc=xxxxxxx,dc=net"

dn: cn=config
add: olcAuthzRegexp
olcAuthzRegexp: "uid=host/([^,]+).xxxxxxx.net,cn=XXXXXXX.NET,cn=gssapi,cn=auth" "cn=$1,ou=hosts,ou=sssd,ou=services,dc=lan,dc=xxxxxxx,dc=net"

It is very important that these host entries are before the uid entries. Otherwise you get a match for a host with the uid mapping.

  1. changed olcAccess statement to
olcAccess: {4}to * 
 by dn="cn=admin,dc=lan,dc=xxxxxxx,dc=net" write 
 by dn="cn=sssdman,ou=manager,dc=lan,dc=xxxxxxx,dc=net" read 
 by dn.one="ou=hosts,ou=sssd,ou=services,dc=lan,dc=xxxxxxx,dc=net" read 
 by self write 
 by anonymous auth 
 by * none
  1. added the host 'test' to the new location in the DIT
dn: cn=test,ou=hosts,ou=sssd,ou=services,dc=lan,dc=xxxxxxx,dc=net
cn: test
objectclass: device
objectclass: hostObject
objectclass: authorizedServiceObject
objectclass: top
authorizedService: host
host: test.nottebrok.net
description: Test Host
1
  • Edit: I moved the host olcAuthzRegexp before the uid olcAuthzRegexp. Now it works. – user12682985 Jan 18 '20 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.