On 04/09/2015 11:19 AM, Guertin, David S. wrote:
If that works it means that you are not using SSSD on RHEL5 clients.
Please check your nsswitch and pam.conf to see what modules are actually
Hmm. /etc/nsswitch.conf contains:

passwd:     files sss ldap
shadow:     files sss ldap
group:      files sss ldap

And /etc/pam.d/system-auth contains:

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass 
password    sufficient    pam_sss.so use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet 
session     required      pam_unix.so
session     optional      pam_sss.so
session     optional      pam_ldap.so

i.e. they both contain both sss and ldap, with sss first. The client was installed with 
the script generated by running "ipa-advise config-redhat-sssd-before-1-9" on 
the server. This script contains:

# Use the authconfig to configure nsswitch.conf and the PAM stack
authconfig --updateall --enablesssd --enablesssdauth

and it also updates the /etc/sssd/sssd.conf file: So why would client not be 
using sssd?

This only means that pam_sss/nss_sss fails and LDAP takes over and works.
You need to look at the sssd logs to see why it fails.
It probably does not find the right servers and falls though to LDAP.

Which RHEL5 versions do you use?
If memory does not fail me if you have SSSD 1.5 (I think it was starting 5.8)
you should be able to use ipa-client-install to configure sssd and pass the list
of the servers in the --server option.
Most of them are RHEL 5.11 with sssd 1.5.1. I'll try reinstalling and passing 
the list of servers with the --server option.

David Guertin

Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.

Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to