Bug 1075141
| Summary: | [GSS 7.0] if access_provider is not set sssd fails with no good error | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Dave Sullivan <dsulliva> |
| Component: | sssd | Assignee: | Jakub Hrozek <jhrozek> |
| Status: | CLOSED ERRATA | QA Contact: | Kaushik Banerjee <kbanerje> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | CC: | dpal, grajaiya, jgalipea, lslebodn, mkosek, pbrezina, preichl, vgaikwad |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http// | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.12.0-1.el7 | Doc Type: | Bug Fix |
| Doc Text: |
Cause: The man pages didn't sufficiently explain that when mixing several different types of providers (such as AD provider and LDAP provider), each provider must be fully configured
Consequence: As a consequence, users were configuring a mix of providers (typically id_provider=ad and access_provider=ldap) without configuring the LDAP provider fully.
Fix: The documentation was amended, stating that the LDAP provider requires separate configuration and is not able to read configuration of the AD provider.
Result: Better documentation, less confused admins.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-03-05 10:27:33 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1064025, 1113520 | ||
|
Description
Dave Sullivan
2014-03-11 14:53:49 UTC
>>> BZ to look for inconsistencies between access_provider and id_provider
>> OK, but I'd like to ask you to formulate exactly what you see
>> as lacking. I'm all for fixing the documentation, but since I know
>> the internals, the inconsistencies might not be apparent to me.
> I think the BZ here is that sssd doesn't show a good error message
> when this the two above are not in sync or correct.
Makes sense. As a matter of fact, we discovered another similar case
last week, where a user wasn't able to troubleshoot a configuration that
included id_provider=ad && sudo_provider=ldap
Upstream ticket: https://fedorahosted.org/sssd/ticket/2281 Fixed upstream:
master: b3f56d9e4bd065590383eb1f812a3b77e3c56f24
Verified in version sssd-1.12.2-39.el7 man sssd-ad now includes: However, unless the “ad” access control provider is explicitly configured, the default access provider is “permit”. Please note that if you configure an access provider other than “ad”, you need to set all the connection parameters (such as LDAP URIs and encryption details) manually. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0441.html |