# Configuring LDAP user authentication
**URL:** https://forums.suse.com/t/configuring-ldap-user-authentication/27689
**Category:** SLES Configure-Administer
**Created:** [December 3, 2015, 7:33pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689 "2015-12-03T19:33:10Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@smily\_03](https://forums.suse.com/u/smily_03)
#### Post date: [December 3, 2015, 7:33pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/1 "2015-12-03T19:33:10Z")
Kinda frustrated because this used to be so easy in SLE11…
Out of curiosity, how do I make it so that we can log into our new SLE12 box with our LDAP accounts?
So far, I’ve got this, from various posts on the forums, but it’s not working…
[https://forums.suse.com/showthread.php?5793-SLE-12-and-LDAP-Authentication](https://forums.suse.com/showthread.php?5793-SLE-12-and-LDAP-Authentication)
[https://forums.suse.com/showthread.php?5698-SLES12-SSSD-Port-status-of-port-636-for-server-bomaster](https://forums.suse.com/showthread.php?5698-SLES12-SSSD-Port-status-of-port-636-for-server-bomaster)
[https://forums.suse.com/showthread.php?6462-SLE-12-Ldap-Authentication-to-clustered-LDAP-Server&highlight=sssd+ldap](https://forums.suse.com/showthread.php?6462-SLE-12-Ldap-Authentication-to-clustered-LDAP-Server&highlight=sssd+ldap)
[https://access.redhat.com/documentation/en-US/Red\_Hat\_Enterprise\_Linux/6/html/Deployment\_Guide/SSSD-Troubleshooting.html#idp17015328](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/SSSD-Troubleshooting.html#idp17015328)
> [@](#):
>
> edit /etc/nsswitch.conf, set:
> passwd: compat sss
> group: compat sss
>
> edit /etc/sssd/sssd.conf, contents:
> [sssd]
> config\_file\_version = 2
> services = nss, pam
> domains = LDAP
>
> [nss]
> filter\_groups = root
> filter\_users = root
>
> [pam]
>
> [domain/LDAP]
> id\_provider = ldap
> auth\_provider = ldap
> ldap\_schema = rfc2307bis
> ldap\_user\_object\_class = posixAccount
> debug\_level = 20
> access\_provider = ldap
> ldap\_uri = ldap://ourldapserver.millikin.edu
> ldap\_search\_base = ou=tech,o=mu
> create\_homedir = true
>
> ldap\_tls\_cacert = /etc/sssd/certs/rootcert.pem
> ldap\_tls\_cacertdir = /etc/sssd/certs
> ldap\_id\_use\_start\_tls = true
>
> execute the following from root’s command line:
> pam-config --add --mkhomedir
I’ve also tried it with an ldap server URL of ldaps://ourserver.millikin.edu:636, but it didn’t make a difference. I also don’t see any references to LDAP connections when I run “netstat -aln | grep tcp”
The thing that’s making this more difficult is that nothing’s getting logged to /var/log/sssd, no matter what value I put in the debug\_level parameter. There aren’t even any files that get created in there. I also tried using ndstrace on the box that this points to (eDirectory on an OES2 box) and it’s not reporting any attempts from this host. Also, /var/log/messages says:
2015-12-03T11:18:59.407125-06:00 muwacmaster sshd[1296]: Invalid user myusername from 172.20.9.87
2015-12-03T11:18:59.411807-06:00 muwacmaster sshd[1296]: input\_userauth\_request: invalid user myusername [preauth]
2015-12-03T11:18:59.414338-06:00 muwacmaster sshd[1296]: Postponed keyboard-interactive for invalid user myusername from 172.20.9.87 port 54501 ssh2 [preauth]
2015-12-03T11:19:01.528568-06:00 muwacmaster sshd[1298]: pam\_unix(sshd:auth): check pass; user unknown
2015-12-03T11:19:01.529166-06:00 muwacmaster sshd[1298]: pam\_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mypc.it.millikin.edu
so it’s like SSSD isn’t even functioning?
When I view the user auth section in YaST it indicates that SSSD is configured though.
What am I doing wrong?
---
### Author:  [@Jens-U](https://forums.suse.com/u/Jens-U)
#### Post date: [December 3, 2015, 7:51pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/2 "2015-12-03T19:51:24Z")
Hi smily\_03,
I see you configured the access\_provider = ldap, but no ldap\_access\_filter. I’m not even sure that you actually wanted to set that 😉
My guess is that sssd is bailing out because of the missing filter. My recommendation is to comment out the access\_provider line and re-test. Care about filtering when you can log in at all 😉
From “man sssd-ldap”:
[QUOTE] ldap\_access\_filter (string)
If using access\_provider = ldap and ldap\_access\_order = filter (default), this option is mandatory. It specifies an LDAP search filter criteria that must be met for the user to be granted access on this host. If
access\_provider = ldap, ldap\_access\_order = filter and this option is not set, it will result in all users being denied access. Use access\_provider = permit to change this default behavior.[/QUOTE]
Regards,
Jens
---
### Author:  [@smily\_03](https://forums.suse.com/u/smily_03)
#### Post date: [December 3, 2015, 9:33pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/3 "2015-12-03T21:33:06Z")
Cool, thanks for posting back Jens 🙂
So far, no luck 😕
I tried commenting out that line, setting the value to “permit”, and setting the value to “ldap” while adding the line
ldap\_access\_filter = objectClass=specialPerson
(where specialPerson is a placeholder for one of our custom ldap classes that’s assigned to “people” on campus)
(Also, I rebooted the box in between each of the changes just to be safe.)
It’s still not logging anything (or creating a log file) in /var/log/sssd either though, and I don’t see anything in …/messages about sssd either?
---
### Author:  [@Jens-U](https://forums.suse.com/u/Jens-U)
#### Post date: [December 4, 2015, 6:19pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/4 "2015-12-04T18:19:18Z")
Hi smily\_03,
> It’s still not logging anything (or creating a log file) in /var/log/sssd either though, and I don’t see anything in …/messages about sssd either?
what does “ps alx|grep sssd” report about the running sssd processes?
If sssd is actually running, I’d like to ask you to give the following minimal LDAP section a try:
`[domain/LDAP][FONT=monospace][COLOR=#000000]
id_provider = ldap [/COLOR]
auth_provider = ldap
;access_provider = ldap
ldap_schema = rfc2307 [/FONT][FONT=monospace]
ldap_uri = ldap://ourldapserver.millikin.edu
ldap_tls_reqcert = allow
cache_credentials = False
enumerate = True[/FONT][FONT=monospace]
debug_level=0x07ff[/FONT]`[FONT=monospace]
[/FONT]
Regards,
Jens
---
### Author:  [@smily\_03](https://forums.suse.com/u/smily_03)
#### Post date: [December 4, 2015, 8:51pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/5 "2015-12-04T20:51:03Z")
Hmm, looks like it’s not even running:
# ps alx | grep sssd
0 0 17897 17867 20 0 10492 928 pipe\_w S+ pts/0 0:00 grep --color=auto sssd
Out of curiosity, what do I need to do to try to get it started?
---
### Author:  [@smily\_03](https://forums.suse.com/u/smily_03)
#### Post date: [December 4, 2015, 8:55pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/6 "2015-12-04T20:55:53Z")
Nevermind, “service sssd start” worked.
---
### Author:  [@smily\_03](https://forums.suse.com/u/smily_03)
#### Post date: [December 4, 2015, 9:16pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/7 "2015-12-04T21:16:21Z")
Ok, after some testing and tweaking, I got this to link up now. But, I’m still not able to log in.
Here’s the last of our sssd log; there’s a lot of random stuff in there, so I’m not sure what’s a “this is failing because” message versus a general message?
[http://susepaste.org/3a5e6d96](http://susepaste.org/3a5e6d96)
---
### Author:  [@Jens-U](https://forums.suse.com/u/Jens-U)
#### Post date: [December 7, 2015, 3:26pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/8 "2015-12-07T15:26:26Z")
Hi smily\_03,
while looking at the current version of the configuration may have been helpful, digging through the logging messages leaves the impression that sssd is unable to handle group memberships.
Have you adjusted your sssd LDAP configuration to match the way your information is stored in your LDAP tree?
Regards,
Jens
---
### Author:  [@smily\_03](https://forums.suse.com/u/smily_03)
#### Post date: [December 7, 2015, 6:23pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/9 "2015-12-07T18:23:39Z")
It would make sense I guess; if it’s expecting to find group membership data, it won’t be able to because we don’t allow that on anonymous binds. Out of curiosity, is there a way to find out what attributes are required for a successful authentication? I haven’t been able to find it in the manpage or my Googling. I’m fine with creating a special bind user for this to use to get the non-public attrs that it’s needing, but I would rather create it with what it needs, rather than giving it access to everything. I can see lists of what it’s looking for in the logs, but don’t know what’s all required, since we don’t have all of those attributes in our schema.
And out of curiosity, is there a doc on the SuSE site anywhere on how to do this? It seems like something should either be straightforward, or well-documented, which it seems neither is the case unfortunately, at least from my searches and experiences thus far. I’m more than happy to write up my experiences after it’s all said and done if there’s some place that I can do so, since I’m guessing that others are going to have similar frustrations. I understand that the functionality has changed since they moved from a generic LDAP client authentication to SSSD, but with how much more complex this is now than it used to be, it almost feels like a functionality regression. (Not grumpy with you, and definitely appreciate your help; just kind of irritated that something that used to take 2 minutes to set up has wasted a couple of days of my time.)
Here’s our current config in sssd.conf:
```auto
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[nss]
filter_groups = root
filter_users = root
[pam]
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_access_filter = muRole=adminRole
ldap_schema = rfc2307bis
ldap_user_object_class = millikinPerson
debug_level = 20
ldap_uri = ldaps://ldap.millikin.edu:636
ldap_search_base = ou=tech,o=mu
create_homedir = true
ldap_tls_cacert = /etc/sssd/certs/rootcert.pem
ldap_tls_cacertdir = /etc/sssd/certs
ldap_id_use_start_tls = true
```
and the latest logs from trying to log in today: [http://susepaste.org/2e76313c](http://susepaste.org/2e76313c)
---
### Author:  [@Lawrence1](https://forums.suse.com/u/Lawrence1)
#### Post date: [December 12, 2015, 6:16pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/10 "2015-12-12T18:16:59Z")
The SSSD is a bit of a new concept and once you get your head around it the complexity reduces. The lack of documentation doesn’t help, so point conceded there.
Using it against eDirectory has its own nuances (primarily due to attribute names) that the SSSD can handle, but before we go there possibly reducing the configuration down to it’s simplest form without access control and go from there. Ensure your proxy user has the required object rights. Use the eDir admin user to test if you are having a proxy user rights issue (never in production ovbiously).
Try:
[sssd]
config\_file\_version = 2
services = nss, pam
domains = LDAP
[nss]
filter\_users = root
filter\_groups = root
[pam]
[domain/LDAP]
id\_provider = ldap
auth\_provider = ldap
enumerate = False
cache\_credentials = True
case\_sensitive = False
ldap\_default\_bind\_dn = \
ldap\_default\_authtok\_type = password
ldap\_default\_authtok = \
ldap\_schema = rfc2307bis
ldap\_user\_name = cn
lldap\_uri = ldaps://ldap.millikin.edu
ldap\_search\_base = ou=tech,o=mu
ldap\_tls\_cacert = /etc/sssd/certs/rootcert.pem
ldap\_tls\_cacertdir = /etc/sssd/certs
ldap\_id\_use\_start\_tls = true
debug\_level = 7
See if you can login using this configuration and then we can look towards access control and home directories.
– lawrence
---
### Author:  [@smily\_03](https://forums.suse.com/u/smily_03)
#### Post date: [December 16, 2015, 6:11pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/11 "2015-12-16T18:11:41Z")
Ok, after much off-thread troubleshooting with the amazing folks on the [TTP ListServ](https://thettp.org/), we’ve got a working setup, which I will document here for others to benefit from:
edit /etc/nsswitch.conf, set:
passwd: compat sss
group: compat sss
edit /etc/sssd/sssd.conf, contents:
```auto
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[nss]
filter_users = root
filter_groups = root
[pam]
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
enumerate = False
cache_credentials = True
case_sensitive = False
ldap_schema = rfc2307bis
ldap_user_name = cn
ldap_uri = ldaps://ldap.millikin.edu
ldap_search_base = ou=base_ou,o=mu
ldap_id_use_start_tls = True
#debug_level = 7
ldap_tls_cacert = /etc/path/to/certs/rootcert.pem
ldap_tls_cacertdir = /etc/path/to/certs
ldap_default_bind_dn = cn=bind_user,ou=base_ou,o=mu
ldap_default_authtok_type = password
ldap_default_authtok = bind_user_password
ldap_user_member_of = groupMembership
ldap_group_name = cn
```
execute the following from root’s command line:
pam-config --add --mkhomedir
pam-config --add --sss
service nscd stop
chkconfig nscd off
Need to also copy the certificate details for the root cert into that rootcert.pem file mentioned in the config. In our case this included the root cert and two intermediate certificates.
---
### Author:  [@Jens-U](https://forums.suse.com/u/Jens-U)
#### Post date: [December 16, 2015, 6:18pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/12 "2015-12-16T18:18:27Z")
Hi smily\_03,
cool - both that you got it up&running and that you provide the according details here as well! Thank you for that!
Best regards,
Jens
---
### Author:  [@smily\_03](https://forums.suse.com/u/smily_03)
#### Post date: [December 16, 2015, 6:31pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/13 "2015-12-16T18:31:53Z")
No problem! 😃
I always hate those threads where I’m like - that’s the EXACT same problem as I’m having, and you read through all the posts, and…it just ends without their solution 😕 So I always try to post my solutions afterwards 🙂
---
### Author:  [@swadm](https://forums.suse.com/u/swadm)
#### Post date: [December 17, 2015, 3:51pm UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/14 "2015-12-17T15:51:28Z")
It is also my observation that sssd appears to be much more straightforward than the previous concepts, see also [Embracing SSSD in Linux](http://geekdom.wesmo.com/2014/05/16/embracing-sssd-in-linux/).
It will probably still take a few years to really hit the road, but SLES(12) people have made a good decision to propagate it in favour of the nss\_ldap / nscd combination.
When debug\_level is set, the log files give fairly detailed and helpful information of what is going on, or … why not.
Cheers, Thomas
---
### Author:  [@Lawrence1](https://forums.suse.com/u/Lawrence1)
#### Post date: [June 17, 2016, 5:36am UTC](https://forums.suse.com/t/configuring-ldap-user-authentication/27689/15 "2016-06-17T05:36:38Z")
To continue the solution to the access control by group membership:
The LDAP ID and AUTH providers are being used against eDirectory so a little bit of schema mapping is required first (as indicated in the previous post):
ldap\_schema = rfc2307bis
ldap\_user\_name = cn
ldap\_user\_member\_of = groupMembership
ldap\_group\_name = cn
Then to perform access control by group membership:
access\_provider = ldap
ldap\_access\_filter = groupMembership=cn=\,ou=LDAP,ou=SVS,o=DVC
The context is an example, obviously.
I hope it helps,
– lawrence