Hi Sumit,

I've trying to download the rpm via the Koji client and have been unable to locate package. Are there any extra steps I need to complete before I can find the package, such as, create an account in Fedora Build System. Performing a general search for SSSD only returns a list of packages from Fedora Projects and nothing from the EL repo.


Thanks,

*Michael Rainey*
NRL 7320
Computer Support Group
Building 1009, Room C156
Stennis Space Center, MS 39529
On 03/22/2016 07:25 AM, Sumit Bose wrote:
On Fri, Mar 18, 2016 at 10:53:08AM -0500, Michael Rainey (Contractor) wrote:
Hi Sumit,

It has been a week and I am following up with you on the lock screen issue.
Have you had any progress?  If so, I am hoping implementing the fix will be
quick and easy.
Thank you for your patience. Please find a test build for RHEL/CentOS
7.2 at https://koji.fedoraproject.org/koji/taskinfo?taskID=13412048 .

Besides the updated version of SSSD you should replace
/etc/pam.d/smartcard-auth with

======== /etc/pam.d/smartcard-auth =========
auth        required      pam_env.so
auth        sufficient    pam_sss.so allow_missing_name
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so


session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet 
use_uid
session     required      pam_unix.so
session     optional      pam_sss.so
===========================================

and /etc/dconf/db/distro.d/10-authconfig

===== /etc/dconf/db/distro.d/10-authconfig =====
[org/gnome/login-screen]
enable-fingerprint-authentication=false

[org/gnome/settings-daemon/peripherals/smartcard]
removal-action='lock-screen'
===============================================

and /etc/dconf/db/distro.d/locks/10-authconfig-locks

====== /etc/dconf/db/distro.d/locks/10-authconfig-locks ===
/org/gnome/login-screen/enable-fingerprint-authentication
/org/gnome/settings-daemon/peripherals/smartcard
===========================================================

and call 'dconf update' to get the new setting loaded. Finally it might
be a good idea to restart gdm to make sure the new setting and PAM
configuration is really active although I would expect that gdm is able
to pick up the changes at run-time.

Any feedback, good or bad, is welcome.

bye,
Sumit

Thanks,

*Michael Rainey*

On 03/11/2016 02:32 AM, Sumit Bose wrote:
On Thu, Mar 10, 2016 at 01:36:15PM -0600, Michael Rainey (Contractor) wrote:
Greetings,

I have been adding systems to my new domain and utilizing the smart card
login feature.  To date the smart card login feature is working very well.
However, my group has been trying to implement locking the screen when the
smart card is removed, but have not been successful at making it work.  Does
anyone have any suggestions as to what it would take to enable locking the
screen when the smart card is removed.
This requires a better integration with gdm which is currently WIP
(https://fedorahosted.org/sssd/ticket/2941). If you don't mind please
ping me in about a week about this again, then I might have done some
more testing.

bye,
Sumit

Thank you in advance.
--
*Michael Rainey*
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to