[Freeipa-users] SSS problems with eDirectory

[Sumit Bose]

On Thu, Jul 22, 2010 at 10:19:37AM +0200, Sumit Bose wrote:
> On Wed, Jul 21, 2010 at 03:22:29PM -0400, Scott Duckworth wrote:
> 
> ...
> 
> > 
> > "something bad happened" isn't very useful.  And since SSS refuses to try
> > and authenticate users without an encrypted connection, I can't easily use
> > wireshark and friends to debug at the protocol level.  While I could
> > probably patch the source to print the actual LDAP error with
> > ldap_err2string(), or maybe gdb the process and set a breakpoint when things
> > go wrong to hopefully get some more useful information, this is beyond what
> > I'd normally consider doing when deploying new software.  Any suggestions?
> 
> I'm currently installing eDirectory and I will try to reproduce the
> behaviour you have found.

I have run some basic authentication test with eDirectory 8.8-SP5 and
everything worked fine. I have to admit that I have used the current
master of sssd which includes a lot of changes to the LDAP code. Would
you mind to test our current beta release from
http://kojipkgs.fedoraproject.org/packages/sssd/1.2.91/21.fc14/ . It is
for rawhide but should work fine on F13, too.

I also didn't use LDAP aliases. Can you check if setting DEREF in
/etc/openldap/ldap.conf helps? If not, can you give a short description
how aliases are used in your case so that I can set up a similar
environment?

Thanks.

bye,
Sumit

> 
> > 
> > Moving on...
> > 
> > We will need to dereference LDAP aliases but I have not yet been able to
> > find a setting to enable this.  I also have not found the equivalent of the
> 
> I have added a RFE to sssd trac
> (https://fedorahosted.org/sssd/ticket/568). As a sort term fix you can
> add the appropriate DEREF option to /etc/openldap/ldap.conf.
> 
> > pam_password_prohibit_message setting in /etc/ldap.conf; while not strictly
> > required, it is nice to refer users to the proper way to change passwords in
> > our environment.
> 
> Currently there is only a configurable message if password resets by
> root fail. I have added https://fedorahosted.org/sssd/ticket/569 to
> track this.
> 
> bye,
> Sumit
> 
> > 
> > Any help would be appreciated.  Thanks!
> > 
> > Scott Duckworth, Systems Programmer II
> > Clemson University School of Computing
> 
> > _______________________________________________
> > Freeipa-users mailing list
> > Freeipa-users at redhat.com
> > https://www.redhat.com/mailman/listinfo/freeipa-users
> 
> _______________________________________________
> Freeipa-users mailing list
> Freeipa-users at redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-users