RHEL 6.4 sssd v1.11.6 Preface : I'm just recently absorbing sssd so I might be missing something here. I assume that you can use the simple access provider with the ad id_provider.
In my domain section: cache_credentials = true id_provider = ad auth_provider = ad access_provider = simple default_shell = /bin/bash fallback_homedir = /home/%u use_fully_qualified_names = false ignore_group_members = true And below I've tried a few things in the domain section: simple_allow_users = bswift ---> this works! simple_allow_groups = sjrb.lg.it.cfg.cdo --> this doesn't work :( I'd really prefer to use the simple provider as it's just easier to configure. We are using puppet as our config management tool so non-admins could submit pull requests via git and they'd only have to know a simpler user API, and not understand SSSD or LDAP queries. Is this a deficiency in the version I'm using? I found a post on this forum where setting "ldap_use_tokengroups = false" might help, tried that.. didn't help. debug_level = 7 gives me this log output (just the last few lines) (Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_access_obtain_filter_lists] (0x0200): Allow users list is empty. (Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_access_obtain_filter_lists] (0x0200): Deny users list is empty. (Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_access_obtain_filter_lists] (0x0200): Deny groups list is empty. (Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_access_check_send] (0x0200): Simple access check for bswift (Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_check_get_groups_send] (0x1000): Looking up groups for user bswift (Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_check_get_groups_send] (0x0400): User bswift is a member of 74 supplemental groups (Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_check_get_groups_send] (0x0400): All groups had name attribute (Wed Nov 16 08:26:48 2016) [sssd[be[SJRB.AD]]] [simple_access_check_recv] (0x1000): Access not granted One thing that may be causing this is in AD under this group name, I see this: "To enable access to this group for UNIX clients you will need to specify the NIS domain this group belongs to." However the dropdown is empty (maybe access rights as I'm not the domain admin). Sometimes what you read on a windows box isn't the full truth.. maybe it is in this case? Any direction here would be appreciated. Thanks! _______________________________________________ sssd-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
