Re: [Freeipa-users] authentication against compat

2014-02-17 Thread Jakub Hrozek
On Fri, Feb 14, 2014 at 09:36:33AM +0200, Alexander Bokovoy wrote: On Thu, 13 Feb 2014, Steve Dainard wrote: I don't think this is an issue of bugs or documentation, more of design. Perhaps there's someplace other than a users list this belongs in but: If IPA is a centrally managed identity

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Jakub Hrozek
On Wed, Feb 12, 2014 at 03:35:58PM -0800, Will Sheldon wrote: Is SSSD working for IPA sudo now? It was working even before, just with a bit of manual config, as I said in the reply you quoted, you just had to configure 'sudo_provider=ldap' I saw this From Jakub Horozek in this list a little

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Steve Dainard
Is this server or client side where sudo_provider=ipa is included in ver 1.11.x? My fedora 20 client doesn't have this option listed, or is it baked in? *Steve Dainard * IT Infrastructure Manager Miovision http://miovision.com/ | *Rethink Traffic* *Blog http://miovision.com/blog | **LinkedIn

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Jakub Hrozek
On Thu, Feb 13, 2014 at 03:05:07PM -0500, Steve Dainard wrote: Is this server or client side where sudo_provider=ipa is included in ver 1.11.x? Client side (sssd) My fedora 20 client doesn't have this option listed, or is it baked in? Where exactly do you see the documentation lacking,

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Steve Dainard
I don't think this is an issue of bugs or documentation, more of design. Perhaps there's someplace other than a users list this belongs in but: If IPA is a centrally managed identity and access control system, should these configurations not be passed to clients, rather than every client needing

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Dmitri Pal
On 02/13/2014 06:04 PM, Steve Dainard wrote: I don't think this is an issue of bugs or documentation, more of design. Perhaps there's someplace other than a users list this belongs in but: If IPA is a centrally managed identity and access control system, should these configurations not be

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Alexander Bokovoy
On Thu, 13 Feb 2014, Steve Dainard wrote: I don't think this is an issue of bugs or documentation, more of design. Perhaps there's someplace other than a users list this belongs in but: If IPA is a centrally managed identity and access control system, should these configurations not be passed

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Alexander Bokovoy
On Wed, 12 Feb 2014, Tamas Papp wrote: hi All, $ ldapsearch -x -D uid=USER,cn=users,cn=compat,dc=foo -h localhost -w `cat pw` ldap_bind: Referral (10) referrals: ldap:///uid=USER,cn=users,cn=accounts,dc=foo [12/Feb/2014:12:54:15 +0100] conn=25363 fd=79 slot=79 connection from ::1

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Tamas Papp
On 02/12/2014 01:07 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: hi All, $ ldapsearch -x -D uid=USER,cn=users,cn=compat,dc=foo -h localhost -w `cat pw` ldap_bind: Referral (10) referrals: ldap:///uid=USER,cn=users,cn=accounts,dc=foo

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Alexander Bokovoy
On Wed, 12 Feb 2014, Tamas Papp wrote: On 02/12/2014 01:07 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: hi All, $ ldapsearch -x -D uid=USER,cn=users,cn=compat,dc=foo -h localhost -w `cat pw` ldap_bind: Referral (10) referrals:

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Tamas Papp
On 02/12/2014 01:34 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: On 02/12/2014 01:07 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: hi All, $ ldapsearch -x -D uid=USER,cn=users,cn=compat,dc=foo -h localhost -w `cat pw` ldap_bind: Referral (10)

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Tamas Papp
On 02/12/2014 01:34 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: On 02/12/2014 01:07 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: hi All, $ ldapsearch -x -D uid=USER,cn=users,cn=compat,dc=foo -h localhost -w `cat pw` ldap_bind: Referral (10)

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Petr Spacek
On 12.2.2014 15:01, Tamas Papp wrote: On 02/12/2014 01:34 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: On 02/12/2014 01:07 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: hi All, $ ldapsearch -x -D uid=USER,cn=users,cn=compat,dc=foo -h localhost

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Tamas Papp
On 02/12/2014 03:04 PM, Petr Spacek wrote: On 12.2.2014 15:01, Tamas Papp wrote: On 02/12/2014 01:34 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: On 02/12/2014 01:07 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: hi All, $ ldapsearch -x -D

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Dmitri Pal
On 02/12/2014 09:30 AM, Tamas Papp wrote: On 02/12/2014 03:04 PM, Petr Spacek wrote: On 12.2.2014 15:01, Tamas Papp wrote: On 02/12/2014 01:34 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: On 02/12/2014 01:07 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Jakub Hrozek
On Wed, Feb 12, 2014 at 01:30:59PM -0500, Dmitri Pal wrote: I don't know it. After a quick look I wasn't able to set it up correctly, 'id USER' didn't connected to it's socket like with nscd/nlscd, however nsswitch.conf was configured. Maybe with the upcoming 14.04 or do you have a working

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Tamas Papp
On 02/12/2014 09:53 PM, Jakub Hrozek wrote: On Wed, Feb 12, 2014 at 01:30:59PM -0500, Dmitri Pal wrote: I don't know it. After a quick look I wasn't able to set it up correctly, 'id USER' didn't connected to it's socket like with nscd/nlscd, however nsswitch.conf was configured. Maybe with

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Alexander Bokovoy
On Wed, 12 Feb 2014, Tamas Papp wrote: On 02/12/2014 09:53 PM, Jakub Hrozek wrote: On Wed, Feb 12, 2014 at 01:30:59PM -0500, Dmitri Pal wrote: I don't know it. After a quick look I wasn't able to set it up correctly, 'id USER' didn't connected to it's socket like with nscd/nlscd, however

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Alexander Bokovoy
On Thu, 13 Feb 2014, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: On 02/12/2014 09:53 PM, Jakub Hrozek wrote: On Wed, Feb 12, 2014 at 01:30:59PM -0500, Dmitri Pal wrote: I don't know it. After a quick look I wasn't able to set it up correctly, 'id USER' didn't connected to

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Tamas Papp
On 02/12/2014 11:29 PM, Alexander Bokovoy wrote: On Wed, 12 Feb 2014, Tamas Papp wrote: On 02/12/2014 09:53 PM, Jakub Hrozek wrote: On Wed, Feb 12, 2014 at 01:30:59PM -0500, Dmitri Pal wrote: I don't know it. After a quick look I wasn't able to set it up correctly, 'id USER' didn't

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Tamas Papp
On 02/12/2014 07:30 PM, Dmitri Pal wrote: Please check SSSD web site for guidelines and if you have any questions do not hesitate to ask on the sssd-users list. SSSD is the best you can get nowadays for the connection of the client systems to the central identity stores. If you plan to use

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Dmitri Pal
On 02/12/2014 05:00 PM, Tamas Papp wrote: On 02/12/2014 07:30 PM, Dmitri Pal wrote: Please check SSSD web site for guidelines and if you have any questions do not hesitate to ask on the sssd-users list. SSSD is the best you can get nowadays for the connection of the client systems to the

Re: [Freeipa-users] authentication against compat

2014-02-12 Thread Will Sheldon
Is SSSD working for IPA sudo now? I saw this From Jakub Horozek in this list a little while back: Unfortunately with 6.5 there is still no sudo ipa provider, there might be with one in 6.6. So in order to download the sudo rules you need to configure the LDAP sudo provider manually. Will. On