Hello,
I'm having trouble adding etoken support to SSSD/openldap on a gentoo.
I have setup nssdb in /etc/pki/nssdb and add Safenet library to access
etoken.
I can successfully get the certificate in token with :
# /usr/libexec/sssd/p11_child --pre --nssdb=/etc/pki/CA/
now, to sssd itself ;
I'm trying an ssh login, and the output on term is :
# ssh [email protected]
Please enter smart card
Please enter smart card
Please enter smart card
[email protected]: Permission denied (publickey,keyboard-interactive).
I can see in p11_child.log that, it use nssdb to (successfully !)
connect to the smartcard.
I can see the correct label, the correct subject.
The keyId is found (I don't understand why i need it and I'm not sure if
the value i picked is right ?)
Anyway, I get my uri, everything seem fine on this side.
Looking at sss_LDAP.log, i can see the request, everything look cool, i
got :
sssd.dataprovider.pamHandler: Success
On the other side, in sss_pam.log i can see the same request but it end
with :
[pam_dp_send_req_done] (0x0200): received: [28 (Module inconnu)][LDAP]
(..)
[pam_eval_prompting_config] (0x4000): No prompting configuration
found.
(Thu Apr 2 15:23:08 2020) [sssd[pam]] [pam_reply] (0x0200): blen: 21
(Thu Apr 2 15:23:08 2020) [sssd[pam]] [pam_reply] (0x0200):
Returning [28]: Module inconnu to the client
(Thu Apr 2 15:23:08 2020) [sssd[pam]] [client_recv] (0x0200):
Client disconnected!
I'm confused at how to understand this.
The sssd.conf is attached.
Thanks,
Marc
[sssd]
config_file_version = 2
reconnection_retries = 3
services = nss, pam
# SSSD will not start if you do not configure any domains.
# Add new domain configurations as [domain/<NAME>] sections, and
# then add the list of domains (in the order you want them to be
# queried) to the "domains" attribute below and uncomment it.
domains = LDAP
certificate_verification = no_oscp
#certificate_verification = no_verification
debug_level = 6
[nss]
#filter_users = root,admin,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
[pam]
pam_cert_auth = True
pam_p11_allowed_services = +sddm, +sddm-helper, +kde, +sshd
p11_wait_for_card_timeout = 10
p11_child_timeout = 10
#debug_level = 6
[domain/files]
id_provider = files
# Example LDAP domain
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
# ldap_schema can be set to "rfc2307", which stores group member names in the
# "memberuid" attribute, or to "rfc2307bis", which stores group member DNs in
# the "member" attribute. If you do not know this value, ask your LDAP
# administrator.
ldap_schema = rfc2307
ldap_uri = ldap://example.com
ldap_search_base = dc=example,dc=com
#ldap_tls_reqcert = never
filter = "(&(objectClass=posixAccount)(uid=%s))"
ldap_user_certificate = userCertificate;binary
# Note that enabling enumeration will have a moderate performance impact.
# Consequently, the default value for enumeration is FALSE.
# Refer to the sssd.conf man page for full details.
enumerate = true
# Allow offline logins by locally storing password hashes (default: false).
cache_credentials = true
[certmap/LDAP/bar]
#matchrule = <ISSUER>^C = FR, ST = France, O = Example, CN = Example
Intermediate CA$
matchrule = <SUBJECT>^CN=bar,O=Example,ST=France,C=FR$
maprule = (userCertificate;binary={cert!bin})
_______________________________________________
sssd-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
