Bug 1684979
| Summary: | The HBAC code requires dereference to be enabled and fails otherwise | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ahmed Nazmy <anazmy> | |
| Component: | sssd | Assignee: | SSSD Maintainers <sssd-maint> | |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> | |
| Severity: | high | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 7.6 | CC: | grajaiya, jhrozek, ksiddiqu, lslebodn, mzidek, pbrezina, sgoveas, ssidhaye, tbordaz, tscherf | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | sssd-1.16.4-14.el7 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1684981 (view as bug list) | Environment: | ||
| Last Closed: | 2019-08-06 13:02:47 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1684981 | |||
|
Description
Ahmed Nazmy
2019-03-04 04:09:32 UTC
Just for recording, in case SSSD requires to use deref control and hit performance issue (long lasting ldap req) then we could investigate an improvement on DS side https://pagure.io/389-ds-base/issue/49951 Upstream ticket: https://pagure.io/SSSD/sssd/issue/3979 * master: * 9d63616 * 1eb3ae1 * sssd-1-16: * 2c97edb * eaceb6a Build used for verification: [root@ipaqavmh ~]# rpm -qa ipa-server sssd ipa-server-4.6.5-8.el7.x86_64 sssd-1.16.4-13.el7.x86_64 [root@ipaqavmh ~]# Since I am still seeing authentication failures, after adding ldap_deref_threshold=0 Marking BZ failed QA Verification procedure On Server [root@ipaqavmh ~]# rpm -qa ipa-* sssd ipa-server-4.6.5-8.el7.x86_64 ipa-server-common-4.6.5-8.el7.noarch ipa-client-4.6.5-8.el7.x86_64 sssd-1.16.4-14.el7.x86_64 ipa-common-4.6.5-8.el7.noarch ipa-client-common-4.6.5-8.el7.noarch ipa-server-dns-4.6.5-8.el7.noarch [root@ipaqavmh ~]# [root@ipaqavmh ~]# grep -nr "ldap_deref_threshold=0" /etc/sssd/sssd.conf 14:ldap_deref_threshold=0 [root@ipaqavmh ~]# [root@ipaqavmh ~]# ipa hbacrule-find -------------------- 2 HBAC rules matched -------------------- Rule name: allow_all User category: all Host category: all Service category: all Description: Allow all users to access any host from any host Enabled: TRUE Rule name: allow_systemd-user User category: all Host category: all Description: Allow pam_systemd to run user@.service to create a system user session Enabled: TRUE ---------------------------- Number of entries returned 2 ---------------------------- [root@ipaqavmh ~]# [root@ipaqavmh ~]# ipa user-add testuser2 --first test --last user2 --password Password: Enter Password again to verify: ---------------------- Added user "testuser2" ---------------------- User login: testuser2 First name: test Last name: user2 Full name: test user2 Display name: test user2 Initials: tu Home directory: /home/testuser2 GECOS: test user2 Login shell: /bin/sh Principal name: testuser2 Principal alias: testuser2 User password expiration: 20190520081820Z Email address: testuser2 UID: 1737200003 GID: 1737200003 Password: True Member of groups: ipausers Kerberos keys available: True ################################################################## On Client [root@ipaqavmc ~]# rpm -qa ipa-* sssd ipa-client-4.6.5-8.el7.x86_64 sssd-1.16.4-14.el7.x86_64 ipa-common-4.6.5-8.el7.noarch ipa-client-common-4.6.5-8.el7.noarch [root@ipaqavmc ~]# [root@ipaqavmc ~]# ssh testuser2.test Password: Password expired. Change your password now. Current Password: Password change failed. Server message: Old password not accepted. Password: Password: Password expired. Change your password now. Current Password: New password: Retype new password: Last failed login: Mon May 20 04:20:36 EDT 2019 from ipaqavmc.idmqe.lab.eng.bos.redhat.com on ssh:notty There were 2 failed login attempts since the last successful login. -sh-4.2$ -sh-4.2$ whoami testuser2 Based on above observations, marking the bugzilla verified. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2019:2177 |